The pardon that approved itself

Описание и применение

Гарант цитирования в Oroboro Labs был изменён так, чтобы одобрять только старые файлы, предотвращая атаки с созданием файлов‑гомонимов после цитирования.

Задача

The citation guard incorrectly approved a pardon when a file with the same name as the cited instrument was created after the citation, allowing attackers to bypass the guard.

Результат

After implementing age-based forgiveness, the guard no longer approves pardons for homonyms created after the citation, eliminating the identified vulnerability while preserving legitimate pardons. Regression sweep confirmed zero new false positives.

Рабочий процесс

• 1. Identify the cited instrument and its creation or backup time. 2. Compare the instrument’s age to the start of the citing window. 3. If the instrument is older than the window, allow the pardon; otherwise, reject it. 4. Run acceptance tests to confirm no false positives and that legitimate pardons still succeed.
• 5. Perform a regression sweep over all instruments to ensure no new false positives are introduced.

Доказательства

The fix is age. A citation is only forgiven when the cited instrument is older than the window citing it

The regression sweep: 113 instruments checked, the same 4 dirty historical copies still flagged, and zero new false positives