# Ref and manifest trust confusion

Security decisions gated on a name or flag that resolves differently than the enforcement code assumes

_Area: Web infrastructure and server-side requests. Seen in 3 disclosed reports; one confirmed bounty: $2,000; latest 2022-06-18. Updated 2026-11-02._

## How it works
Two components read the same identifier and disagree on what it means. A security check trusts a manifest flag or a ref name, while the feature that actually runs reads a different field or resolves the name differently. The assumption that breaks: that the value the gate inspects is the value the runtime uses. In InfoPath, `managedCode enabled=no` suppresses the code warning while code still runs, removing `publishUrl` skips the domain check, and `taskpane href` is not limited to embedded HTML [E1](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-embedding-payloads-bypassing-controls-microsoft-infopath.md). In Git, a branch named as a 40-char hex string shadows the commit hash, so `git checkout <hash>` lands on attacker code [E2](https://bugbountylibrary.com/r/h1%3A790634.md). In curl's Secure Transport backend, `CURLOPT_SSLCERT` is resolved as a file path before the keychain nickname is looked up [E3](https://bugbountylibrary.com/r/h1%3A1234760.md).

## Where it shows up
- Manifest/config flags that gate a warning or check (`enabled`, `publishUrl`, `href`) while the loader reads other fields [E1](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-embedding-payloads-bypassing-controls-microsoft-infopath.md)
- Ref names accepted as 40-char hex, or any namespace where a name can collide with an ID [E2](https://bugbountylibrary.com/r/h1%3A790634.md)
- One option accepting either a name or a path, with resolution order unspecified [E3](https://bugbountylibrary.com/r/h1%3A1234760.md)
- Consumers that pin by hash: CI, dependency refs, submodules [E2](https://bugbountylibrary.com/r/h1%3A790634.md)
- Sibling backends/parsers that implement the same option differently [E3](https://bugbountylibrary.com/r/h1%3A1234760.md)

## How to review
For each security gate, find the exact field the enforcement reads and the exact field the runtime acts on; they must be the same, or the gate must re-derive from the runtime value. For ref resolution, the invariant is: a hash reference resolves to that commit or fails, never to a branch. For name-or-path options, the invariant is: keychain/nickname lookup happens before filesystem resolution, or the two are disambiguated explicitly. Compare sibling implementations for a guard one has and the other lacks [E3](https://bugbountylibrary.com/r/h1%3A1234760.md).

## How finders spotted it
- Saw `FormServer.aspx?XsnLocation=` on SharePoint, downloaded the `.xsn`, unpacked the CAB, read `manifest.xsf`, then flipped `enabled`, `publishUrl` and `taskpane href` to probe the three-tier model [E1](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-embedding-payloads-bypassing-controls-microsoft-infopath.md)
- Noticed git prefers a branch over a commit hash on ambiguity, then tested that GitLab (unlike GitHub) accepts 40-char hex branch names [E2](https://bugbountylibrary.com/r/h1%3A790634.md)
- Read the Secure Transport code, saw it lacked the keychain-vs-file disambiguation present in `nss.c`, then planted a same-named file in the CWD and observed cert load failure [E3](https://bugbountylibrary.com/r/h1%3A1234760.md)

## Variants seen
- Manifest flag suppressing a warning while code still executes [E1](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-embedding-payloads-bypassing-controls-microsoft-infopath.md)
- Manifest field removal skipping a domain restriction [E1](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-embedding-payloads-bypassing-controls-microsoft-infopath.md)
- Unrestricted `href` accepting arbitrary executables/HTA [E1](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-embedding-payloads-bypassing-controls-microsoft-infopath.md)
- Branch name shadowing a commit hash [E2](https://bugbountylibrary.com/r/h1%3A790634.md)
- Option resolving path before keychain nickname [E3](https://bugbountylibrary.com/r/h1%3A1234760.md)

## Impact and severity
InfoPath: bypass of managed-code warning and publishUrl domain restriction, with payload delivery via taskpane; potential no-click path via IE/JScript memory corruption noted [E1](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-embedding-payloads-bypassing-controls-microsoft-infopath.md). GitLab: dependents pinning by hash redirected to attacker code [E2](https://bugbountylibrary.com/r/h1%3A790634.md). curl: planted file blocks keychain client-cert auth [E3](https://bugbountylibrary.com/r/h1%3A1234760.md). Severity rises when the confused value feeds a downstream consumer (CI, dependencies) or a no-click delivery path [E1](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-embedding-payloads-bypassing-controls-microsoft-infopath.md)[E2](https://bugbountylibrary.com/r/h1%3A790634.md).

## Seen in real software
Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix.
- **Microsoft InfoPath** (manifest.xsf (managedCode, publishUrl, taskpane href)) (version not stated): Embedding Payloads and Bypassing Controls in Microsoft InfoPath. Report: https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-embedding-payloads-bypassing-controls-microsoft-infopath.md
- **GitLab**: When you call your branch the same name as a git hash, it could be checked out by dependents. Report: https://bugbountylibrary.com/r/h1%3A790634.md
- **curl**: CVE-2021-22926: CURLOPT_SSLCERT mixup with Secure Transport (CVE-2021-22926). Report: https://bugbountylibrary.com/r/h1%3A1234760.md

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-embedding-payloads-bypassing-controls-microsoft-infopath.md
- E2: https://bugbountylibrary.com/r/h1%3A790634.md
- E3: https://bugbountylibrary.com/r/h1%3A1234760.md