fix: address RUSH-594 P0 audit issues by muqsitnawaz · Pull Request #27 · phnx-labs/linear-cli

muqsitnawaz · 2026-07-21T21:22:14Z

Summary

Fixes the RUSH-594 P0 code issues by writing config files with private permissions, moving issue filters and lookups to GraphQL variables, and pinning/checksum-verifying the installer download.
Corrects the README P0 issues by reducing the badge wall, promoting manual install over pipe-to-shell, pinning install URLs, and removing repeated/stale size and supply-chain claims.

Key Evidence

Config writes now create ~/.linear-cli with 0700 and config.json with 0600: linear:74, linear:75, linear:78, linear:83.
Issue listing now passes IssueFilter through variables instead of interpolated query text: linear:876, linear:886, linear:893, with callers building dict filters at linear:1202 and linear:1347.
Direct issue lookups now use $filter variables: linear:705, linear:711, linear:1422, linear:1442.
Installer pins v0.13.0 and verifies SHA-256 before moving into place: install.sh:7, install.sh:8, install.sh:27, install.sh:47.
README keeps only License/Python badges and demotes pipe-to-shell behind pinned manual install: README.md:5, README.md:6, README.md:24, README.md:31.

Verification

python3 -m unittest -v -> 27 tests passed.
python3 -m py_compile linear test_linear.py && ./linear --version && sh -n install.sh && git diff --check -> linear-cli 0.13.0, no errors.
Isolated installer run: HOME=/tmp/linear-install-home-U3WcTL sh install.sh; installed /tmp/linear-install-home-U3WcTL/.local/bin/linear, linear-cli 0.13.0, SHA-256 d62ee380d5565e483f0750ded837b5d453fcc380ffab14fe1d34249d2079a1c2.

Linear: RUSH-594

muqsitnawaz · 2026-08-05T22:21:04Z

-BRANCH="${LINEAR_CLI_BRANCH:-main}"
-URL="https://raw.githubusercontent.com/${REPO}/${BRANCH}/linear"
+VERSION="${LINEAR_CLI_VERSION:-v0.13.0}"
+EXPECTED_SHA256="${LINEAR_CLI_SHA256:-d62ee380d5565e483f0750ded837b5d453fcc380ffab14fe1d34249d2079a1c2}"


P0 blocking: the checksum-pinned install path still ships the pre-fix, vulnerable script.

EXPECTED_SHA256 here is d62ee380d5565e483f0750ded837b5d453fcc380ffab14fe1d34249d2079a1c2. I fetched the actual linear blob at the v0.13.0 tag (ref=fd1adff48bc1a8c1feccd05389736c73406dc7d3, which is this PR's own base commit) and its SHA-256 is exactly that hash — confirmed with shasum -a 256 linear_v0130.py → d62ee380d5565e483f0750ded837b5d453fcc380ffab14fe1d34249d2079a1c2.

That v0.13.0-tagged file still has the pre-fix code this PR is supposed to remove:

6 unsafe f-string-interpolated GraphQL query blocks (grep -n 'f"""' linear_v0130.py → lines 380, 390, 689, 871, 1409, 1724, vs. only 1 (safe, non-user-data) f-string left at linear:886 in this PR's HEAD).

No CONFIG_DIR_MODE/write_config_file at all (grep -n 'CONFIG_DIR_MODE\|write_config_file' linear_v0130.py → no matches).

Since __version__ is not bumped in this PR (linear still declares __version__ = "0.13.0" at HEAD) and no new tag is cut here, curl ... install.sh | sh (default LINEAR_CLI_VERSION=v0.13.0) will keep downloading and correctly verifying the checksum of the unfixed script after this PR merges. The PR body's own "Isolated installer run" verification (linear-cli 0.13.0, same SHA) is actually evidence of this: it can't distinguish fixed vs. unfixed since the version string and checksum are identical either way.

This needs a new tag (e.g. v0.14.0) cut from this PR's HEAD, with VERSION/EXPECTED_SHA256 here (and the README links) repointed to it — otherwise this P0 fix never reaches anyone who installs via the documented path.

muqsitnawaz · 2026-08-05T22:21:10Z


 ```bash
-curl -sSL https://raw.githubusercontent.com/phnx-labs/linear-cli/main/install.sh | bash
+curl -fL -o /usr/local/bin/linear https://raw.githubusercontent.com/phnx-labs/linear-cli/v0.13.0/linear


Same root cause as the install.sh:8 comment: this manual-install curl pulls linear from the v0.13.0 git tag, which is this PR's own base commit (fd1adff4) — i.e. the pre-fix script, still containing the f-string-interpolated GraphQL filters (team_id, identifier lookups) this PR is meant to close. Until a new tag is cut from this PR's HEAD and this URL (and the install.sh one two lines below) is repointed to it, following this README instruction after merge still installs the vulnerable binary.

muqsitnawaz · 2026-08-05T22:21:19Z

@@ -63,19 +65,29 @@ def load_config() -> dict:
        return json.loads(CONFIG_PATH.read_text())


Non-blocking, but worth tracking: permission hardening only applies on write. load_config() reads CONFIG_PATH as-is (return json.loads(CONFIG_PATH.read_text())) with no chmod — so an existing user upgrading from a pre-fix install, whose ~/.linear-cli/config.json already exists with loose (e.g. default-umask 0644) permissions and a plaintext API key, stays that way until the next save_config() call (e.g. after setup/update), not immediately on upgrade.

Also, the legacy-migration branch a few lines below (write_config_file(cfg) at what is now linear:69) writes the new ~/.linear-cli/config.json with correct 0600/0700 perms, but never touches or removes the old ~/.agents/linear.json it just read from — that file keeps holding the same plaintext API key at its original (unhardened) permissions indefinitely.

Suggest a one-time perms fix-up (chmod on existing CONFIG_PATH/parent at the top of load_config) and cleaning up (or at least chmod-ing) the legacy file post-migration, so the P0 fix actually protects users who are upgrading, not just fresh installs.

muqsitnawaz · 2026-08-05T22:22:47Z

Git-review routine — changes requested (blocking). The security fixes in this diff are genuine (GraphQL filter injection closed, config now 0700/0600), but the delivery ships the OLD vulnerable script:

install.sh:8 pins the pre-fix checksum. EXPECTED_SHA256=…d62ee380… is the SHA-256 of the linear blob at the v0.13.0 tag (this PR base fd1adff), which still has 6 f-string-interpolated GraphQL blocks and no write_config_file. __version__ stays 0.13.0 and no new tag is cut, so curl … install.sh | sh keeps serving the unfixed script — with a checksum that "verifies". fix: address RUSH-594 P0 audit issues #27 (comment)
README.md:27,34 curl/manual-install both point at the pre-fix v0.13.0 tag. fix: address RUSH-594 P0 audit issues #27 (comment)
Non-blocking: linear:65 read/upgrade path never chmods an existing loose config.json, and the legacy ~/.agents/linear.json plaintext key is never removed/hardened. fix: address RUSH-594 P0 audit issues #27 (comment)

To ship the fix: bump the version, cut+push a new tag on the fixed commit, recompute the installer checksum, and point README/install.sh at the new tag. Not merged.

muqsitnawaz · 2026-08-06T07:57:06Z

Superseded for the remaining security scope (config 0600 + install pin/checksum) by #32 — fresh branch off current main (0.16.1). This PR conflicts with main and still pins pre-fix v0.13.0. Prefer landing #32; close this after that merges.

muqsitnawaz · 2026-08-06T08:01:18Z

Superseded by #32 (merged).

PR #32 lands the remaining RUSH-2285 / RUSH-594 security P0s on current main at 0.16.1:

config dir 0700 / file 0600 + harden-on-load
install.sh pin + SHA-256 fail-closed

This PR (#27) was conflicted and still pinned pre-fix v0.13.0 plus broader README/GraphQL scope. Closing as superseded; security half is on main via #32.

muqsitnawaz · 2026-08-06T08:01:19Z

Closing as superseded by merged #32 (RUSH-2285).

muqsitnawaz added 2 commits July 21, 2026 14:22

docs: start RUSH-594 README P0 cleanup

84163e9

fix: address RUSH-594 P0 audit issues

86d9d99

muqsitnawaz changed the title ~~WIP: fix RUSH-594 P0 audit issues~~ fix: address RUSH-594 P0 audit issues Jul 21, 2026

muqsitnawaz marked this pull request as ready for review July 21, 2026 21:27

muqsitnawaz commented Aug 5, 2026

View reviewed changes

muqsitnawaz mentioned this pull request Aug 6, 2026

fix(security): config 0600 + install pin/checksum (RUSH-2285) #32

Merged

muqsitnawaz closed this Aug 6, 2026

Navigation Menu

Uh oh!

fix: address RUSH-594 P0 audit issues - #27

fix: address RUSH-594 P0 audit issues#27
muqsitnawaz wants to merge 2 commits into
mainfrom
rush-594-p0-audit

muqsitnawaz commented Jul 21, 2026 •

edited

Loading

Uh oh!

muqsitnawaz Aug 5, 2026

Uh oh!

muqsitnawaz Aug 5, 2026

Uh oh!

muqsitnawaz Aug 5, 2026

Uh oh!

muqsitnawaz commented Aug 5, 2026

Uh oh!

muqsitnawaz commented Aug 6, 2026

Uh oh!

muqsitnawaz commented Aug 6, 2026

Uh oh!

muqsitnawaz commented Aug 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

		@@ -63,19 +65,29 @@ def load_config() -> dict:
		return json.loads(CONFIG_PATH.read_text())

Uh oh!

Conversation

muqsitnawaz commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Key Evidence

Verification

Uh oh!

muqsitnawaz Aug 5, 2026

Choose a reason for hiding this comment

Uh oh!

muqsitnawaz Aug 5, 2026

Choose a reason for hiding this comment

Uh oh!

muqsitnawaz Aug 5, 2026

Choose a reason for hiding this comment

Uh oh!

muqsitnawaz commented Aug 5, 2026

Uh oh!

muqsitnawaz commented Aug 6, 2026

Uh oh!

muqsitnawaz commented Aug 6, 2026

Uh oh!

muqsitnawaz commented Aug 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

muqsitnawaz commented Jul 21, 2026 •

edited

Loading