gabriel / musehub public
fix minor dev
AI Agent gabriel · 166 days ago · Apr 12, 2026 · Diff

fix: allow shebangs in script files; fix JSONValue ForwardRef in ORM Mapped[]

magic_bytes.py: add _SHEBANG_ALLOWED_EXTENSIONS — .py/.sh/.rb/etc. legitimately start with #! and are not polyglot attacks. Shebang is still blocked for binary extensions (.mid, .mp3, .png, etc.).

ORM models: import JSONValue alongside JSONObject so SQLAlchemy's get_type_hints() can resolve the ForwardRef('JSONValue') inside JSONObject's recursive union when evaluating Mapped[JSONObject].

Tests: 4 new shebang cases in TestMagicBytes (2 allowed, 2 blocked). All 47 security hardening tests pass.

sha256:81d0cf7541eef99804fa907faaf67e2d2c8075a29a9a9ee40f9d32ff645660c8 sha
sha256:92f5ed9399578b9af221e2b9c8071fdb6f7183c70f17b6be7b55c2610e24f9ea parent
+9 ~6 symbols
sha256:c7f479192db7ea381816c5312dc6037673cb12853e522e05707eaf13beac041c snapshot
+9
symbols added
~6
symbols modified
0
dead code introduced
Semantic Changes 15 symbols
~ musehub/db/coord_models.py .py 1 symbol added, 1 symbol modified
+ JSONValue import import JSONValue L42–42
~ JSONObject
~ musehub/db/muse_cli_models.py .py 1 symbol added, 1 symbol modified
+ JSONValue import import JSONValue L17–17
~ JSONObject
~ musehub/db/musehub_domain_models.py .py 1 symbol added, 1 symbol modified
+ JSONValue import import JSONValue L28–28
~ JSONObject
~ musehub/db/musehub_models.py .py 1 symbol added, 1 symbol modified
+ JSONValue import import JSONValue L32–32
~ JSONObject
~ musehub/security/magic_bytes.py .py 1 symbol added, 1 symbol modified
+ _SHEBANG_ALLOWED_EXTENSIONS variable variable _SHEBANG_ALLOWED_EXTENSIONS L140–144
~ check_magic_bytes
~ tests/test_security_hardening_section82.py .py 4 symbols added, 1 symbol modified
+ test_script_shebang_in_py_file_allowed method method test_script_shebang_in_py_file_allowed L81–84
+ test_script_shebang_in_sh_file_allowed method method test_script_shebang_in_sh_file_allowed L86–88
+ test_shebang_still_blocked_in_binary_extensions method method test_shebang_still_blocked_in_binary_extensions L90–92
+ test_shebang_still_blocked_in_midi_extension method method test_shebang_still_blocked_in_midi_extension L94–95
~ TestMagicBytes
← Older Oldest on dev
All commits
Newer → Latest on dev

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:81d0cf7541eef99804fa907faaf67e2d2c8075a29a9a9ee40f9d32ff645660c8 --body "your comment"