Capture addon --set option values are unvalidated/unescaped before mitmdump invocation #186

New issue

Open

opened 2026-09-05 04:35:18 +00:00 by mara · 0 comments

mara commented

2026-09-05 04:35:18 +00:00

Collaborator

Reviewed at commit 3b4e2da (filed against capture wiring from 26675e5, IPX addon #154; interacts with replay from 6f40a44).

Problem
capture-addon-setting (source/hackmode-core/capture-provider.lisp, ~line 50) formats addon options as (format nil "~a=~a" name value) and these are passed to mitmdump as --set name=value. There is no escaping or validation of VALUE.

Repro
Operation id, capture-session id, or spool path values flow into these arguments directly (make-capture-process-specification). A value containing a newline or control character, or an id containing =, is parsed differently by mitmdump than intended. Since hackmode_spool_path is a filesystem path derived from operation/session ids, malformed ids silently bind a wrong spool path and evidence lands in an unexpected file.

Suggested fix
Validate operation/capture-session/spool ids and paths at make-capture-process-specification (reject spaces, control chars, = in ids; reject control chars in paths), or pass options to mitmdump via a generated config file instead of CLI --set. Add a test that a spec with a malformed id fails loudly instead of binding a wrong spool path.

Reviewed at commit 3b4e2da (filed against capture wiring from 26675e5, IPX addon #154; interacts with replay from 6f40a44). **Problem** `capture-addon-setting` (`source/hackmode-core/capture-provider.lisp`, ~line 50) formats addon options as `(format nil "~a=~a" name value)` and these are passed to mitmdump as `--set name=value`. There is no escaping or validation of VALUE. **Repro** Operation id, capture-session id, or spool path values flow into these arguments directly (`make-capture-process-specification`). A value containing a newline or control character, or an id containing `=`, is parsed differently by mitmdump than intended. Since `hackmode_spool_path` is a filesystem path derived from operation/session ids, malformed ids silently bind a wrong spool path and evidence lands in an unexpected file. **Suggested fix** Validate operation/capture-session/spool ids and paths at `make-capture-process-specification` (reject spaces, control chars, `=` in ids; reject control chars in paths), or pass options to mitmdump via a generated config file instead of CLI `--set`. Add a test that a spec with a malformed id fails loudly instead of binding a wrong spool path.

mara added the

refactor

label

2026-09-05 04:35:18 +00:00