{"record":{"id":"b0b13f4cd115bb0c","repo":"ruvnet/ruflo","slug":"wgfirewallservice-refusing-unsafe-label-jso","errorCode":null,"errorMessage":"WgFirewallService: refusing unsafe ${label}: ${JSON.stringify(s)}","messagePattern":"WgFirewallService: refusing unsafe (.+?): (.+?)","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"v3/@claude-flow/plugin-agent-federation/src/domain/services/wg-firewall-service.ts","lineNumber":78,"sourceCode":"  switch (process.platform) {\n    case 'linux': return 'linux-nftables';\n    case 'darwin': return 'darwin-pf';\n    default:\n      // Other platforms (win32/freebsd) — fall back to linux-nftables since\n      // most production federation hosts are linux. The operator can\n      // override via config.platform.\n      return 'linux-nftables';\n  }\n}\n\n/**\n * Defense-in-depth: every value spliced into a rule line goes through this\n * filter. Allows the chars `nft`/`pf` syntax actually needs and refuses\n * anything else — a poisoned manifest can't escape the rule string.\n */\nfunction assertSafeRuleArg(s: string, label: string): void {\n  if (!/^[A-Za-z0-9_./:-]+$/.test(s)) {\n    throw new Error(`WgFirewallService: refusing unsafe ${label}: ${JSON.stringify(s)}`);\n  }\n}\n\nfunction projectRuleNftables(rule: WgPortRule, srcIP: string): string {\n  if (rule.proto === 'all') {\n    return `        ip saddr ${srcIP} accept`;\n  }\n  if (rule.port !== undefined) {\n    return `        ip saddr ${srcIP} ${rule.proto} dport ${rule.port} accept`;\n  }\n  if (rule.portRange) {\n    const [lo, hi] = rule.portRange;\n    return `        ip saddr ${srcIP} ${rule.proto} dport ${lo}-${hi} accept`;\n  }\n  throw new Error(`projectRuleNftables: rule missing port/portRange/all: ${JSON.stringify(rule)}`);\n}\n\nfunction projectRulePf(rule: WgPortRule, iface: string, srcIP: string): string {","sourceCodeStart":60,"sourceCodeEnd":96,"githubUrl":"https://github.com/ruvnet/ruflo/blob/fa13ee4ad60ac2090b1480656eb233521790d640/v3/@claude-flow/plugin-agent-federation/src/domain/services/wg-firewall-service.ts#L60-L96","documentation":"Defense-in-depth guard in assertSafeRuleArg: before any value is spliced into an nftables/pf rule line it is checked against a strict character allowlist. Fires when a firewall rule argument (e.g. a peer endpoint, IP, or key taken from a possibly poisoned remote manifest) contains characters outside the set nft/pf syntax actually needs, meaning an injection attempt or corrupt data would otherwise escape its slot in the rule string.","triggerScenarios":"WgFirewallService rejects a rule/label value that contains unsafe characters or patterns.","commonSituations":"User-supplied firewall input containing shell metacharacters, newlines, or invalid tokens.","solutions":["Sanitize the input so it contains only characters allowed for the given label.","Construct firewall rules from validated structured fields instead of raw strings."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fa13ee4ad60ac2090b1480656eb233521790d640","analyzedAt":"2026-08-18T21:34:22.708Z","contentChangedAt":"2026-08-18T21:34:22.708Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}