GHSA-jm28-2wcr-qf3h: OliveTin: StartActionAndWait Endpoints Bypass `logs` Permission and Return Action Output

Summary The synchronous execution RPCs StartActionAndWait and StartActionByGetAndWait return the full LogEntry for the just-executed action without checking whether the caller is allowed to read that action's logs. OliveTin's ACL model separates exec from logs. A deployment can intentionally allow a user to run an action while denying access to its historical or live output. That separation is enforced in GetLogs, GetActionLogs, ExecutionStatus, and EventStream, but it is not enforced in the synchronous ...AndWait endpoints. As a result, any user who can execute an action through these endpoints can read the action output immediately even when the action's ACL explicitly sets logs:false. Details OliveTin defines separate per-action permissions: // service/internal/config/config.go type PermissionsList struct { View bool koanf:"view" Exec bool koanf:"exec" Logs bool koanf:"logs" Kill bool koanf:"kill" } The normal log and streaming paths correctly enforce logs permission: // service/internal/api/api.go func (api *oliveTinAPI) isLogEntryAllowed(e *executor.InternalLogEntry, user *authpublic.AuthenticatedUser) bool { if user == nil || !isValidLogEntry(e) { return false } return acl.IsAllowedLogs(api.cfg, user, e.Binding.Action) } That check is used by: - GetLogs - GetActionLogs - ExecutionStatus - EventStream However, the synchronous execution endpoints directly return the created LogEntry without any logs ACL check: // service/internal/api/api.go func (api *oliveTinAPI) StartActionAndWait(ctx ctx.Context, req *connect.Request[apiv1.StartActionAndWaitRequest]) (*connect.Response[apiv1.StartActionAndWaitResponse], error) { ... internalLogEntry, ok := api.startActionAndWaitRun(binding, args, user) if !ok { return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("execution not found")) } return connect.NewResponse(&apiv1.StartActionAndWaitResponse{ LogEntry: api.internalLogEntryToPb(internalLogEntry, user), }), nil } func (api *oliveTinAPI) StartActionB