2026 week 34 update

[syan-tibco]

Summary

Weekly sync from the private repository, covering weeks 25-34 (55 commits since the last sync on 2026-06-16).

The main driver this cycle is a round of security hardening of the Platform Automation Hub (the Flask + Playwright bootstrap service under docs/recipes/automation/tp-setup/bootstrap/), together with a large expansion of its regression test coverage. The rest is automation reliability work tracking recent Control Plane UI changes.

Changes

• Automation Hub security hardening: closed unauthenticated command injection / RCE through /run-cli-script, blocked arbitrary module loading and environment injection through /run-gui-script, fixed SSRF in /cp_api and in license upload that could leak the Control Plane bearer token (upload is now pinned to the tenant CP with TLS restored), sanitized /upload filenames and closed a zip-slip in activation-zip extraction, redacted /get_env to a non-secret allowlist and locked CORS, and blocked kubeconfig exec-plugin RCE via TP_AUTO_KUBECONFIG.
• MCP Hub automation: adapted to the Fresco Register wizard (page → modal, multi-step flow, DP dropdown, gateway online-wait) and to the MCP Hub 1.20 Add flow, made gateway deployment idempotent on retry, recovered from superseded gateway ids, bound gateway reuse to the current data plane id, and moved the remaining controls onto test-id selectors.
• Infra MCP Server: renamed the K8s MCP Server automation to Infra MCP Server and fixed its provisioning flow.
• Observability automation: o11y is now configured through the UI with both data planes switched to the Global resource, dashboards are created for Integration_General and Messaging_General, and several wizard races were fixed (async-rendered toggles, absent System Config toggle for the Global resource, add-card failures now surface instead of passing silently).
• Data plane capabilities: auto-provisioning for ActiveSpaces including its o11y card, BCCE (tibco-cp-bc) capability toggle onboarded default-off, BW5CE utilities install driven off the BW5CE enable flag, Start Flogo/BWCE/BW5CE App toggles honoured in CLI mode, proactive BW5/BW6 product-permission grants on the BMDP install path, and unsatisfiable capability requests are now refused instead of crashing.
• Test coverage: 39 new pytest suites and 6 new bats suites covering the security fixes, the new selectors, and the capability flag guards; the bootstrap pytest suite is now enforced in CI.
• Reliability and infrastructure: helm pull is retried, each pipeline run gets its own scratch files, BMDP registration fails loudly when it yields no commands, the on-prem automation source can be staged instead of cloned, MSYS path conversion is disabled on Windows so the tibtunnel accessKey is not mangled, plus an NGF fix, an Azure CLI update, and automation image / chart version bumps across the recipes.

Sync Details

• Source: tibco/platform-provisioner @ 9d52c6a3
• Branch: releases/202634
• Date: 2026-08-23
• Files changed: 110 (+19,852 / -1,047)

🤖 Generated with Claude Code

[owen-pengtao]

APPROVED — AIP review · 4 lenses (security primary / qa / performance / design) · No CRITICAL.

Weekly public-repo sync of weeks 25–34 (55 commits, +19.9k/-1k). The dominant theme is a well-executed round of security hardening of the Automation Hub (Flask + Playwright bootstrap service), plus a large regression-test expansion and automation-reliability fixes tracking recent CP UI changes (PCP-20335 / PCP-21866 / PCP-22439 et al).

Security (primary) — PASS (net improvement).

• server.py: wildcard CORS dropped (TPSEC-124); /cp_api SSRF closed with a positive api_path guard (single leading slash + netloc equality) that runs before the bearer token is fetched, and deliberately no curl -L so a CP 3xx can't bounce the token (TPSEC-116); /run-gui-script constrained to a first-party case allowlist, fail-safe 404 (TPSEC-135); /get_env converted to a strict default-deny non-secret allowlist with URL userinfo stripping and a default-off dev opt-in (TPSEC-124).
• Env-injection sink hardened: _BLOCKED_REQUEST_ENV_KEYS/prefixes block NODE_*/LD_*/PYTHON*/KUBECONFIG/GIT_SSH* etc., and /run-cli-script is further namespaced to TIBCOP_CLI_* (TPSEC-134).
• helper.py: kubeconfig exec-plugin RCE guard with a fail-closed quote/pathsep parsing-differential defense (TPSEC-163); zip-slip + symlink-member rejection via a shared is_within containment predicate (TPSEC-128); MSYS_NO_PATHCONV fix for the tibtunnel accessKey (PCP-20701).
• Reasoning is sound and consistently fails closed. The residual argument-injection through free-text other_args/description params reaching tibcop's generated scripts is explicitly acknowledged in-code and tracked separately (the holistic fix being endpoint authN) — not a regression introduced here.

QA / Testing — strong.

• 39 new pytest suites + 6 bats suites, one per security fix (test_run_cli_script_injection, test_server_cp_api_ssrf, test_upload_path_traversal, test_helper_get_env_vars_kubeconfig, test_server_get_env, test_server_run_gui_script_allowlist, …); bootstrap pytest suite now enforced in CI.

Performance — no concerns. New polling helpers (check_dom_enabled, check_dom_attribute) have bounded waits and never raise.

Design / Consistency — good. Single-source-of-truth constants for allowlists / index prefix / containment; extensive rationale comments; consistent with sibling automation patterns.

Should-address (none blocking):

• none

Nice-to-have:

• _SHELL_DANGEROUS_CHARS intentionally omits quotes/space (positive RFC-1123 validation covers the k8s identifiers); the free-text residual is already tracked — worth folding into the same follow-up that authenticates the endpoint.

(C0 H0 M0 L1)