AutopilotMonitor/rules/ime-log-patterns/IME-IMPERSONATION.json at 7323ca72b29460f73613d1da2d4cc2289e5d7ac8 - AutopilotMonitor - Grace Solutions

gsadmin/AutopilotMonitor

mirror of https://github.com/okieselbach/AutopilotMonitor.git synced 2026-10-24 12:42:38 +00:00

Files

T

Oliver Kieselbach 09492e908c fix(security): IME log-pattern pack is anchored and linear (all 90 patterns start with ^, IME-APP-VERSION spells the report-delta JSON out instead of a chained [^}]*? scan) and the ImeLogTracker read loop is bounded — BoundedLineReader (32 MB per line, evidence: real 5.6 MB "Get policies" lines; exact byte bookmarks, no decoder read-ahead loss on cancel), 2 s per-line matching budget across all patterns, held-back unterminated EOF tails (≤1 MB, 1 s settle) instead of dropping them and raw-matching fragments, a complete entry after a dropped one is no longer swallowed as its close, one Warning per pass (oversizedLines/regexTimeouts/lineBudgetBreaks) instead of silent Debug timeouts; unanchored PS-SCRIPT-CONTEXT false positives on [Win32App] SideCarScript… lines (which overwrote the pending platform script's RunContext) are gone; --run-ime-matching assembles multiline entries like the tracker

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-08-30 14:03:50 +02:00

10 lines

307 B

JSON

Raw Blame History

 {
   "$schema": "../schema/ime-log-pattern.schema.json",
   "patternId": "IME-IMPERSONATION",
   "category": "always",
   "pattern": "^After impersonation: (?<user>.*?)$",
   "action": "imeImpersonation",
   "description": "Detects when IME impersonates a user context for app installation.",
   "enabled": true
 }