[bitWarrior]

Related Issue(s)	None. Extends the directory sandboxing added in #5320, #5404, #5833 and #5850 to the sequencers.
Has Unit Tests (y/n)	y
Documentation Included (y/n)	y
Generative AI was used in this contribution (y/n)	y

---

Change Description

• CmdSequencer::configureSandbox(directory): a sequence load whose file name resolves outside the directory is rejected with the new CS_FileOutsideSandbox event before the file is opened, and the command responds EXECUTION_ERROR. This covers CS_VALIDATE, CS_RUN, seqRunIn, seqDispatchIn and loadSequence. The check is in CmdSequencerImpl::loadFile, so it applies to every sequence format: F´, AMPCS (including its .CRC32 companion file), and any format set with setSequenceFormat.
• FpySequencer::configureSandbox(directory): the same check for sequence reads in validate() (RUN, RUN_ARGS, VALIDATE, VALIDATE_ARGS, seqRunIn) and for the DUMP_STACK_TO_FILE output file. Rejections log the new FileOutsideSandbox event. The event is appended at the end of FpySequencerEvents.fppi so that existing auto-assigned event IDs do not change.
• Opt-in: until configureSandbox() is called, any path is allowed, so existing deployments behave the same.
• SDDs: CmdSequencer §3.3.2.6 and a FpySequencer "File Sandbox" section.

Rationale

FileUplink, FileDownlink, FileManager and PrmDb can be restricted to a directory, but the sequencers opened whatever path a command or port supplied. A deployment that configured restricted sandboxes still had sequence loads, and FpySequencer's stack-dump write, outside them. This closes that gap using the same Os::FilePathUtils resolve-and-contain check that FileManager uses.

Testing/Review Recommendations

• New tests:
  • CmdSequencer: Immediate.Sandbox and Immediate.SandboxAMPCS. They check that a load inside the sandbox succeeds, that CS_VALIDATE and CS_RUN outside the sandbox are rejected, and that .. traversal is rejected.
  • FpySequencer: validate_sandbox checks the same cases. cmd_DUMP_STACK_TO_FILE_sandbox checks that a dump to ../ is rejected and the file is not created, and that a dump inside the sandbox still succeeds.
• With the check disabled, all four new tests fail.
• fprime-util check: CmdSequencer 97/97 and FpySequencer 340/340 pass.
• Review points:
  • Default. The sandbox is opt-in rather than fail-closed like FileManager and PrmDb. The sequencers are not part of a subtopology that sets a default, so fail-closed would break every deployment that uses them.
  • Ref. Ref is not changed, because its integration tests run sequences from /tmp.
  • Symlinks. As with Os::SandboxedFile, path checks are textual and do not follow symlinks.

Future Work

• Ref could demonstrate configureSandbox once its integration-test sequences live inside the sandbox directory.

Contributor Checklist

• I have the rights to contribute this change set under the Apache-2.0 license.
• I agree to be bound by the contributor guidelines.

AI Usage (see policy)

Claude Code (Claude Opus 5.5) was used for the analysis, the code changes, the unit tests and the SDD updates, under the contributor's direction. The contributor chose the design (opt-in default, coverage of both sequencers) and reviewed the changes.

• This contribution follows the F´ AI development skills (entered through AGENTS.md).

🤖 Generated with Claude Code

[github-actions]

Coverage report — base devel

Overall (line): 85.52% → 85.53% (+0.01)
Regression threshold: 0.50% (line).

Regressions

(none over threshold)

Modules changed

Module	Line	Δ	Function	Δ	Branch	Δ
Svc/FpySequencer	87.04	+0.12	99.09	+0.01	79.32	+0.16
Svc/CmdSequencer	93.62	+0.15	98.17	+0.04	84.17	+0.30
Fw/DataStructures	97.87	+0.80	97.14	+0.00	82.48	+1.28

New modules

Module	Line	Function	Branch
Fw/Prm	0.00	0.00	0.00

Modules without UTs

CFDP/Checksum/GTest, Drv/LinuxGpioDriver, Drv/LinuxI2cDriver, Drv/LinuxSpiDriver, Drv/Ports/DataTypes, Drv/PosixUartDriver, FppTestProject/FppTest/topology/async, FppTestProject/FppTest/topology/components/Comp, FppTestProject/FppTest/topology/components/Framework, FppTestProject/FppTest/topology/components/Receiver, FppTestProject/FppTest/topology/components/Sender, FppTestProject/FppTest/topology/guarded, FppTestProject/FppTest/topology/sync, FppTestProject/FppTest/topology/top_ports, FppTestProject/FppTest/topology/types, Fw/Com, Fw/Comp, Fw/FilePacket/GTest, Fw/Fpy, Fw/Obj, Fw/Port, Fw/Sm, Fw/Test, Fw/Types/GTest, Os/Models, Svc/Ccsds/Types, Svc/Ccsds/Utils, Svc/FatalHandler, Svc/Subtopologies/CdhCore, Svc/Subtopologies/ComCcsds, Svc/Subtopologies/ComCcsdsSdls, Svc/Subtopologies/ComFprime, Svc/Subtopologies/ComLoggerTee, Svc/Subtopologies/DataProducts, Svc/Subtopologies/DpCompression, Svc/Subtopologies/FileHandling, Svc/Subtopologies/FileHandlingCfdp, Svc/Subtopologies/FileHandlingCfdp/FileHandlingCfdpConfig, TestDeploymentsProject/Ref/DpDemo, TestDeploymentsProject/Ref/PingReceiver, TestDeploymentsProject/Ref/RecvBuffApp, TestDeploymentsProject/Ref/SendBuffApp, TestDeploymentsProject/Ref/Top, TestDeploymentsProject/Ref/TypeDemo, cmake/test/data/TestConfigDeployment, cmake/test/data/TestDeployment/TestBuildAutocoder, cmake/test/data/TestDeployment/TestDuplicateDirective, cmake/test/data/TestDeployment/TestHeaderAutocoder, cmake/test/data/TestDeployment/TestLinkDepends, cmake/test/data/TestDeployment/TestRelative, cmake/test/data/test-fprime-library/TestLibrary/TestComponent, cmake/test/data/test-fprime-library2/TestLibrary2/TestComponent

[jashory]

Thanks @bitWarrior for the super fast turnaround on this and for extending configureSandbox(directory) to cover both Svc/CmdSequencer (F´ and AMPCS .CRC32 companion formats) and Svc/FpySequencer (validate() and DUMP_STACK_TO_FILE), along with the 4 unit tests (Immediate.Sandbox, Immediate.SandboxAMPCS, validate_sandbox, and cmd_DUMP_STACK_TO_FILE_sandbox)!

Reviewed the changes in CmdSequencerImpl.cpp and FpySequencer.cpp — opting into Os::FilePathUtils::checkPathInDirectory when m_sandboxDir is configured cleanly preserves backward compatibility for existing deployments while closing the out-of-sandbox path gap. Could you please also add a brief Reported-by: HM Shihabuddin Jashory (@jashory) credit note in the PR description/commit message since GHSA-pq8v-c63j-wv29 was closed privately? Appreciate your work!

[zimri-leisher]

@bitWarrior please make sure to add me as a reviewer on PRs that touch FpySequencer

[jashory]

Thank you @bitWarrior, @LeStarch, and @thomas-bc for implementing and merging PR #6299 (a2b049b889ba1396b6bf9e440c7fd9c09fe172d2) into devel to resolve GHSA-pq8v-c63j-wv29 across Svc/CmdSequencer and Svc/FpySequencer!

Quick follow-up question regarding the advisory lifecycle:

1. Now that the fix is merged into devel, could GHSA-pq8v-c63j-wv29 be transitioned from Closed to Published (and assigned a CVE ID if applicable) so that the official GitHub Security Advisory URL (https://github.com/nasa/fprime/security/advisories/GHSA-pq8v-c63j-wv29) is publicly viewable for academic and security researcher portfolio verification?
2. Does NASA JPL / NASA VDP issue an official Letter of Recognition directly for resolved nasa/fprime GitHub Security Advisories, or should we also cross-reference this remediated advisory through the Bugcrowd NASA VDP portal (bugcrowd.com/engagements/nasa-vdp) for Hall of Fame tracking?

Thank you again for the rapid triage and collaboration!
— HM Shihabuddin Jashory (@jashory, ORCID: 0009-0003-4163-0092)