Repository navigation

FIX: Refuse saved targets that would authenticate with a key (part 7) - #4025

Open

varunj-msft wants to merge 137 commits into

microsoft:mainfrom

varunj-msft:varunj-msft/13178-Refuse-Saved-Target-Keys

Open

FIX: Refuse saved targets that would authenticate with a key (part 7)#4025
varunj-msft wants to merge 137 commits into
microsoft:mainfrom
varunj-msft:varunj-msft/13178-Refuse-Saved-Target-Keys

Commits on Oct 26, 2026
Commits on Nov 2, 2026
Commits on Nov 3, 2026
- Test that a description at the limit is accepted
  varunj-msft
  committed
  e45865b
- Merge the description limit test
  varunj-msft
  committed
  b6927a9
- Show only the error type when a URL in it may carry credentials
  varunj-msft
  committed
  c94ffbd
- Merge the safer failure messages
  varunj-msft
  committed
  ac849a9
- Point the restore message at where failures are listed and guard the benchmark's recipes folder
  varunj-msft
  committed
  26377ea
- Cut failure messages at any URL query or fragment and hide any with user info
  varunj-msft
  committed
  8663852
- Merge the stricter failure messages
  varunj-msft
  committed
  4159905
- Escape text that isn't UTF-8 in restore reports so they can be sent as JSON
  varunj-msft
  committed
  9a419b4
- Merge the report text escaping
  varunj-msft
  committed
  8fb8095
- Read error text as plain normalized text and say when part of it is hidden
  varunj-msft
  committed
  9a67367
- Merge the plain, normalized failure text
  varunj-msft
  committed
  82c957f
- Escape entry names in restore reports too
  varunj-msft
  committed
  274b4ce
- Merge the entry name escaping
  varunj-msft
  committed
  95f9492
- Show error text with its original characters
  varunj-msft
  committed
  a60323a
- Test that a reference name that isn't valid text can still be reported
  varunj-msft
  committed
  e7558a4
- Merge the original-character error text and escaped entry names
  varunj-msft
  committed
  0e8490c
- Test that the runtime status can report a reference name that isn't valid text
  varunj-msft
  committed
  686d475
- Escape report text only when it is sent as JSON
  varunj-msft
  committed
  c391b0d
- Merge the JSON-only report escaping
  varunj-msft
  committed
  0b44db6
- Check each character on its own so long error messages stay fast
  varunj-msft
  committed
  f986da5
- Merge the per-character check and JSON-only report escaping
  varunj-msft
  committed
  807a904
- Check the exact message for every form of each mark and bound the work per character
  varunj-msft
  committed
  c86bfe6
- Merge the exact look-alike message checks
  varunj-msft
  committed
  454d05b
- Test that the runtime status can list a file name that isn't valid text
  varunj-msft
  committed
  9f91282
- Pass the look-alike check's arguments by keyword
  varunj-msft
  committed
  a455494
- Test that a technique waits for a saved converter in either list and reports an unknown attack type
  varunj-msft
  committed
  ce8b684
- Merge the converter-list and attack-type tests
  varunj-msft
  committed
  d48a12c
- Test that restore runs after the startup scripts, at startup and on apply
  varunj-msft
  committed
  74412fe
- Keep the offline browser fixture away from saved registry entries
  varunj-msft
  committed
  784cd45
- Check the opened file before reading it and skip links deleted since the listing
  varunj-msft
  committed
  507567b
- Merge the opened-file check
  varunj-msft
  committed
  9d37ba3
- Merge the opened-file check
  varunj-msft
  committed
  ff2c836
- Merge origin/main
  varunj-msft
  committed
  3afdcaa
- Let restore set the path parameters a target lets callers set, as the API does
  varunj-msft
  committed
  de2f4e3
- Merge the opened-file check, main and the caller path parameters
  varunj-msft
  committed
  e821e7e
- Close a file that isn't regular before reporting it and report entries that can't be checked
  varunj-msft
  committed
  a45ac23
- Merge the file handle fix
  varunj-msft
  committed
  60477e8
- Merge the file handle fix
  varunj-msft
  committed
  28f2262
- Give only targets the path parameters their class lets callers set
  varunj-msft
  committed
  ad21f0c
- Merge the file handle fix and the target-only caller paths
  varunj-msft
  committed
  3dc4768
Commits on Nov 4, 2026
- Test a file replaced just before it's opened and stop a blocked read with a watchdog
  varunj-msft
  committed
  db245dc
- Merge the opened-file tests
  varunj-msft
  committed
  5d3d2d0
- Merge the opened-file tests
  varunj-msft
  committed
  07a617f
- Merge the opened-file tests
  varunj-msft
  committed
  2b4f1cc
- Read saved recipes separately from building them
  varunj-msft
  committed
  80754a2
- Merge the separate recipe read
  varunj-msft
  committed
  7965020
- Build restored entries on the runtime loop and read them in a worker thread
  varunj-msft
  committed
  bd84ef0
- Show every signed-in user why saved registry entries couldn't be restored
  varunj-msft
  committed
  1a192f7
- Retry restoring saved registry entries without a restart
  varunj-msft
  committed
  4fb7f35
- Drop a late retry answer when the runtime failed again between polls
  varunj-msft
  committed
  27ef572
Commits on Nov 5, 2026
- Keep Retry in reach and say when the failure list couldn't be loaded
  varunj-msft
  committed
  fa1ae56
- Stop a scan whose launch scripts would replace a saved entry
  varunj-msft
  committed
  1af1d00
- Report a saved-entry clash when a launch script wraps the refusal
  varunj-msft
  committed
  17d6fe0
- Merge origin/main
  varunj-msft
  committed
  b829bb8
- Refuse saved targets that would authenticate with a key
  varunj-msft
  committed
  a230568
- Check where saved targets send requests
  varunj-msft
  committed
  232857e
- Accept only plain addresses and paths as saved target destinations
  varunj-msft
  committed
  034522d
- List presets, suites, and initializers through the checked listing
  varunj-msft
  committed
  d1bdd82
- Merge the shared document listing
  varunj-msft
  committed
  f5ed760
- Merge the shared document listing
  varunj-msft
  committed
  4b55b17
- Merge the shared document listing
  varunj-msft
  committed
  a1866d5
- Merge the shared document listing
  varunj-msft
  committed
  e8dc897
- Merge the shared document listing
  varunj-msft
  committed
  09a98af
- Merge the shared document listing
  varunj-msft
  committed
  5ce5bb9
- Report a preset, suite, or initializer folder that can't be read as unavailable storage
  varunj-msft
  committed
  76dbf9c
- Merge the storage error mapping for unreadable folders
  varunj-msft
  committed
  f823e4b
- Merge the storage error mapping for unreadable folders
  varunj-msft
  committed
  99da684
- Merge the storage error mapping for unreadable folders
  varunj-msft
  committed
  2c58145
- Merge the storage error mapping for unreadable folders
  varunj-msft
  committed
  5a0afa6
- Merge the storage error mapping for unreadable folders
  varunj-msft
  committed
  6bb9aec
- Merge the storage error mapping for unreadable folders
  varunj-msft
  committed
  a4790e9
- Test each saved target URL rule on its own
  varunj-msft
  committed
  d70837c
- Describe what a saved target can use more precisely
  varunj-msft
  committed
  4ce3214
Commits on Nov 6, 2026
- Test the remaining saved target URL rules on their own
  varunj-msft
  committed
  b3b8ac5
- Say which saved target addresses are checked
  varunj-msft
  committed
  8a44952
- Merge origin/main
  varunj-msft
  committed
  6800d15
- Merge origin/main
  varunj-msft
  committed
  74839cd
- Merge origin/main
  varunj-msft
  committed
  ee3e64f
- Take out the restore retry changes merged here by mistake
  varunj-msft
  committed
  15e7a9e
- Merge origin/main
  varunj-msft
  committed
  368b914
Commits on Nov 7, 2026
- Log why storage is unavailable, without its path or URL
  varunj-msft
  committed
  7d9ac2f
- Merge the storage error logging
  varunj-msft
  committed
  7b5bfeb
- Merge the storage error logging
  varunj-msft
  committed
  22806d8
- Hide a restore message with a percent escape, which can hide a credential
  varunj-msft
  committed
  34011c9
- Merge the storage error logging and the percent-escape fix
  varunj-msft
  committed
  8a0113f
- Merge the storage error logging and the percent-escape fix
  varunj-msft
  committed
  8d51b6c
- Merge the storage error logging and the percent-escape fix
  varunj-msft
  committed
  6ddd960
- Stop a launch whose script catches the duplicate-name error for a saved entry
  varunj-msft
  committed
  dc4125c
- Merge the duplicate-name refusal for saved entries
  varunj-msft
  committed
  febc8c3
- Merge origin/main
  varunj-msft
  committed
  e03fd18
Commits on Nov 8, 2026
- Merge origin/main
  varunj-msft
  committed
  031dc61
- Merge origin/main
  varunj-msft
  committed
  7f8ab0d
- Import the saved recipe models from their package, as main now requires
  varunj-msft
  committed
  19205b1
- Merge origin/main
  varunj-msft
  committed
  0348a0b
- Import from public packages, as main now requires
  varunj-msft
  committed
  bba3afd
- Merge origin/main
  varunj-msft
  committed
  d4ccd50
- Merge origin/main
  varunj-msft
  committed
  ed01798
- Record a saved entry's name clash wherever a launch script can catch it
  varunj-msft
  committed
  98766ec
- Merge origin/main
  varunj-msft
  committed
  6fb1e00
- Import from public packages, as main now requires
  varunj-msft
  committed
  405c2bd
- Check a target that takes no credentials as the default auth mode
  varunj-msft
  committed
  13bd3ab
Commits on Nov 9, 2026
- Report storage failures with one error and answer them with 503
  varunj-msft
  committed
  622bbb8
- Merge the single storage error
  varunj-msft
  committed
  1cae0b9
- Escape file names once and simplify the saved recipe models
  varunj-msft
  committed
  eba7bf2
- Merge the recipe model simplification
  varunj-msft
  committed
  9f24124
- Report restore bugs as build errors and log each failure once
  varunj-msft
  committed
  2bbfc8f
- Merge the restore logging and build error fixes
  varunj-msft
  committed
  3735dbc
- Stay ready when a saved entry can't be restored, and hold its name
  varunj-msft
  committed
  ca7563d
Commits on Nov 10, 2026
- Merge the stay-ready restore
  varunj-msft
  committed
  a9dfc86
- Reset the registries between runtime tests, as a real startup does
  varunj-msft
  committed
  67416f1
- Merge the runtime test isolation
  varunj-msft
  committed
  e6e419e
- Stop a launch whose script takes the name of a saved entry that failed
  varunj-msft
  committed
  81c0317
- Merge origin/main
  varunj-msft
  committed
  6ee84f0
- Merge origin/main
  varunj-msft
  committed
  d43a7e8
- Merge origin/main
  varunj-msft
  committed
  0664063
- Merge origin/main
  varunj-msft
  committed
  3b3ac59
- Merge origin/main
  varunj-msft
  committed
  04fe60f
- Merge origin/main
  varunj-msft
  committed
  6911327
- Refuse OpenAI targets while the server sets OPENAI_CUSTOM_HEADERS
  varunj-msft
  committed
  ee45962
- Explain that a credential refusal also covers using this server's credentials
  varunj-msft
  committed
  51d4fff

Commits

Commits on Oct 26, 2026

Commits on Nov 2, 2026

Commits on Nov 3, 2026

Commits on Nov 4, 2026

Commits on Nov 5, 2026

Commits on Nov 6, 2026

Commits on Nov 7, 2026

Commits on Nov 8, 2026

Commits on Nov 9, 2026

Commits on Nov 10, 2026