lei.chen/myxce
1
0
Fork 1
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs(buglog): log follow-ups of the P0 fixes (bug-1958..bug-1966)

Browse source 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Rongsong Shen 2026-10-10 10:16:33 +00:00
parent 19be145d6f
commit 7b77ce9c1d
Signed by untrusted user: rshen
GPG key ID: 80533536B0EB651C
10 changed files with 659 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

215
.wolf/buglog.json
View file

@ -18422,6 +18422,221 @@
"record": ".wolf/bugs/bug-1957.md",
"gitea_issue": 388,
"gitea_synced_status": "fixed"
},
{
"id": "bug-1958",
"status": "open",
"status_updated": "2026-10-10",
"status_note": "newly logged",
"component": "apiserver",
"severity": "security",
"timestamp": "2026-10-10T10:15:56Z",
"last_seen": "2026-10-10T10:15:56Z",
"occurrences": 1,
"error_message": "apiserver lets any rbac:control grant create roles and extend its own role (privilege escalation)\n\n**Observed:** (source reading; follow-up of the 2026-10-10 P0 fixes (bug-1936..1957))\nReported by the bug-1952 fix: role create/update in `controllers/roles.go` accepts any `rbac:control` scope, so a user holding `rbac:control` with scope `self` can add `cluster:control` (or any permission) to a role it already holds: the same escalation bug-1952 closed for user-role assignment, by another route.\n\n**Expected:** Creating roles or changing a role's permissions requires `rbac:control` with scope `all` (as user-role changes do since bug-1952).\n**Impact:** Security: privilege escalation through role editing.\n**Found by:** follow-up of the 2026-10-10 P0 fixes (bug-1936..1957)",
"file": "src/frontend/apiserver/controllers/roles.go",
"root_cause": "TODO: required for fixed/partial",
"fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why",
"tags": [
"apiserver",
"security",
"rbac"
],
"related_bugs": [
"bug-1952"
],
"fix_commits": [],
"record": ".wolf/bugs/bug-1958.md"
},
{
"id": "bug-1959",
"status": "open",
"status_updated": "2026-10-10",
"status_note": "newly logged",
"component": "xcecli",
"severity": "security",
"timestamp": "2026-10-10T10:15:59Z",
"last_seen": "2026-10-10T10:15:59Z",
"occurrences": 1,
"error_message": "xcecli logout only clears local config and never calls the logout API, so the token is not revoked\n\n**Observed:** (source reading; follow-up of the 2026-10-10 P0 fixes (bug-1936..1957))\nReported by the bug-1946 fix: server-side token revocation exists (`POST /xce/v1/auth/logout`), but `xcecli logout` deletes the local token without calling it, so the token stays valid until expiry.\n\n**Expected:** `xcecli logout` calls the logout API (best effort) before clearing local state.\n**Impact:** Security: a CLI token survives logout.\n**Found by:** follow-up of the 2026-10-10 P0 fixes (bug-1936..1957)",
"file": "src/frontend/xcecli/cmd/auth",
"root_cause": "TODO: required for fixed/partial",
"fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why",
"tags": [
"xcecli",
"security",
"jwt"
],
"related_bugs": [
"bug-1946"
],
"fix_commits": [],
"record": ".wolf/bugs/bug-1959.md"
},
{
"id": "bug-1960",
"status": "open",
"status_updated": "2026-10-10",
"status_note": "newly logged",
"component": "controller",
"severity": "wrong-result",
"timestamp": "2026-10-10T10:16:02Z",
"last_seen": "2026-10-10T10:16:02Z",
"occurrences": 1,
"error_message": "closed queues accept submissions: controller never checks, apiserver skips the default queue\n\n**Observed:** (source reading; follow-up of the 2026-10-10 P0 fixes (bug-1936..1957))\nReported by the bug-1938 fix: `handle_jobsubmit()` (`src/controller/job.c`) never checks `QUEUE_STAT_CLOSED`; the apiserver's check in `preCheckJobRequest()` runs only when a queue name is given, so a submission without one goes to `normal` unchecked, and non-REST submit paths (libxce, harness) are not checked at all.\n\n**Expected:** A submission to a closed queue (explicit or default) is rejected with a clear error on every submit path.\n**Impact:** Admin queue close silently ignored for default-queue and non-REST submissions.\n**Found by:** follow-up of the 2026-10-10 P0 fixes (bug-1936..1957)",
"file": "src/controller/job.c, src/frontend/apiserver/controllers/jobs.go",
"root_cause": "TODO: required for fixed/partial",
"fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why",
"tags": [
"controller",
"apiserver",
"queue",
"admin-control"
],
"related_bugs": [
"bug-1938"
],
"fix_commits": [],
"record": ".wolf/bugs/bug-1960.md"
},
{
"id": "bug-1961",
"status": "open",
"status_updated": "2026-10-10",
"status_note": "newly logged",
"component": "apiserver",
"severity": "wrong-result",
"timestamp": "2026-10-10T10:16:04Z",
"last_seen": "2026-10-10T10:16:04Z",
"occurrences": 1,
"error_message": "apiserver ControlHost writes a second response after validateHost rejected the request\n\n**Observed:** (source reading; follow-up of the 2026-10-10 P0 fixes (bug-1936..1957))\nReported by the bug-1949 fix: `validateHost` (`controllers/hosts.go`) writes a 403 via `ReturnError` without aborting and `ControlHost` continues and writes another response (today masked by the route's RequirePermission).\n\n**Expected:** A rejected host control stops after the first error response.\n**Impact:** Wrong result / noise: double responses, possible action after a rejection if the route guard changes.\n**Found by:** follow-up of the 2026-10-10 P0 fixes (bug-1936..1957)",
"file": "src/frontend/apiserver/controllers/hosts.go",
"root_cause": "TODO: required for fixed/partial",
"fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why",
"tags": [
"apiserver",
"hosts"
],
"related_bugs": [],
"fix_commits": [],
"record": ".wolf/bugs/bug-1961.md"
},
{
"id": "bug-1962",
"status": "open",
"status_updated": "2026-10-10",
"status_note": "newly logged",
"component": "apiserver",
"severity": "security",
"timestamp": "2026-10-10T10:16:07Z",
"last_seen": "2026-10-10T10:16:07Z",
"occurrences": 1,
"error_message": "apiserver JWT excluded-path check drops the last character of every entry, matching unintended paths\n\n**Observed:** (source reading; follow-up of the 2026-10-10 P0 fixes (bug-1936..1957))\n`ValidateHandler.isExcludedPath` (`middleware/validatehandler.go:52-61`) trims the last character of every excluded entry, not only a trailing `*`, and matches by prefix: `/ping` matches any path starting with `/pin`, and `/swagger/*any` never matches.\n\n**Expected:** Exact entries match exactly; only entries ending in `*` match by prefix.\n**Impact:** Security: paths that merely share a prefix with an excluded entry skip JWT validation.\n**Found by:** follow-up of the 2026-10-10 P0 fixes (bug-1936..1957)",
"file": "src/frontend/apiserver/middleware/validatehandler.go",
"root_cause": "TODO: required for fixed/partial",
"fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why",
"tags": [
"apiserver",
"security",
"jwt"
],
"related_bugs": [],
"fix_commits": [],
"record": ".wolf/bugs/bug-1962.md"
},
{
"id": "bug-1963",
"status": "investigating",
"status_updated": "2026-10-10",
"status_note": "suspected; confirm with a scheduler fixture test",
"component": "scheduler",
"severity": "wrong-result",
"timestamp": "2026-10-10T10:16:09Z",
"last_seen": "2026-10-10T10:16:09Z",
"occurrences": 1,
"error_message": "xce_scheduler host iteration offers unavailable or reconciling hosts as placement candidates\n\n**Observed:** (source reading; follow-up of the 2026-10-10 P0 fixes (bug-1936..1957))\nSuspected (reported by the bug-1939 fix, not verified): `sched_host_iter_next()` (`src/scheduler/src/host_iter.c`) skips admin-closed hosts since bug-1939 but not `XCE_WORKER_UNAVAIL` or `XCE_WORKER_RECONCILING`; other checks (`resource.c:704,887`, `core_session.c:136`) are accounting skips, not placement filters.\n\n**Expected:** Unavailable and reconciling hosts get no new placements.\n**Impact:** Possible dispatch to a dead or reconciling host (dispatch then fails and is retried).\n**Found by:** follow-up of the 2026-10-10 P0 fixes (bug-1936..1957)",
"file": "src/scheduler/src/host_iter.c",
"root_cause": "TODO: required for fixed/partial",
"fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why",
"tags": [
"scheduler",
"host"
],
"related_bugs": [],
"fix_commits": [],
"record": ".wolf/bugs/bug-1963.md"
},
{
"id": "bug-1964",
"status": "open",
"status_updated": "2026-10-10",
"status_note": "newly logged",
"component": "scheduler",
"severity": "wrong-result",
"timestamp": "2026-10-10T10:16:12Z",
"last_seen": "2026-10-10T10:16:12Z",
"occurrences": 1,
"error_message": "xce_scheduler --sim does not re-seed limits when a config push arrives mid-replay\n\n**Observed:** (source reading; follow-up of the 2026-10-10 P0 fixes (bug-1936..1957))\nReported by the bug-1943 fix: the simulator seeds the limit plugin only at bootstrap (`sim_bootstrap_limit_plugin`); a CONFIG_PUSH during replay updates groups (bug-1943) but a new or changed limit config never reaches the limit plugin, while the live scheduler applies it (`plugin_config_update`).\n\n**Expected:** Live and simulated scheduling apply the same limits after a config change.\n**Impact:** Replays that span a limit config change decide differently than live.\n**Found by:** follow-up of the 2026-10-10 P0 fixes (bug-1936..1957)",
"file": "src/scheduler/src/sim_limit.c, src/scheduler/src/core_events.c",
"root_cause": "TODO: required for fixed/partial",
"fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why",
"tags": [
"scheduler",
"sim",
"equivalence",
"limit"
],
"related_bugs": [
"bug-1943"
],
"fix_commits": [],
"record": ".wolf/bugs/bug-1964.md"
},
{
"id": "bug-1965",
"status": "open",
"status_updated": "2026-10-10",
"status_note": "newly logged",
"component": "build",
"severity": "noise",
"timestamp": "2026-10-10T10:16:14Z",
"last_seen": "2026-10-10T10:16:14Z",
"occurrences": 1,
"error_message": "xce-build.sh apiserver skips the middleware, router and cmd Go test packages\n\n**Observed:** (source reading; follow-up of the 2026-10-10 P0 fixes (bug-1936..1957))\n`xce-build.sh` runs `go test ./store/... ./utils/... ./controllers/... ./backend/...` for the apiserver; `./middleware/...`, `./router/...`, `./cmd/...` (which hold several security tests since bug-1945..1952) are never run by the build.\n\n**Expected:** The build runs every apiserver test package.\n**Impact:** Regressions in middleware/router/cmd tests go unnoticed by `/xce-build`.\n**Found by:** follow-up of the 2026-10-10 P0 fixes (bug-1936..1957)",
"file": "src/tools/xce-build.sh",
"root_cause": "TODO: required for fixed/partial",
"fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why",
"tags": [
"build",
"tests",
"apiserver"
],
"related_bugs": [],
"fix_commits": [],
"record": ".wolf/bugs/bug-1965.md"
},
{
"id": "bug-1966",
"status": "open",
"status_updated": "2026-10-10",
"status_note": "newly logged",
"component": "apiserver",
"severity": "noise",
"timestamp": "2026-10-10T10:16:16Z",
"last_seen": "2026-10-10T10:16:16Z",
"occurrences": 1,
"error_message": "apiserver swagger generation fails on hosts.go models.Error; published swagger is a stale stub\n\n**Observed:** (source reading; follow-up of the 2026-10-10 P0 fixes (bug-1936..1957))\n`swag init -g cmd/main.go` fails: `ParseComment error in controllers/hosts.go for comment: '// @Failure 400 {object} models.Error': cannot find type definition: models.Error`. `docs/swagger.yaml` is a 212-line stub last generated before the meson merge (no job-control endpoints).\n\n**Expected:** Swagger generates from the annotations and the published spec covers the API.\n**Impact:** API documentation missing/stale.\n**Found by:** follow-up of the 2026-10-10 P0 fixes (bug-1936..1957)",
"file": "src/frontend/apiserver/controllers/hosts.go, src/frontend/apiserver/docs/swagger.yaml",
"root_cause": "TODO: required for fixed/partial",
"fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why",
"tags": [
"apiserver",
"docs",
"swagger"
],
"related_bugs": [],
"fix_commits": [],
"record": ".wolf/bugs/bug-1966.md"
}
]
}