 Hermes
|
2d68197272
|
security: Fix path traversal and add SSL verification hardening
Addresses audit findings S002 (Path Traversal) and S004 (SSL Verification):
S002 - Path Traversal Vulnerabilities (CWE-22):
- Created src/shared/security_utils.py with centralized security functions:
* validate_path_within_root() - Ensures paths stay within allowed directories
* safe_join_path() - Safe path joining with traversal detection
* sanitize_filename() - Removes dangerous characters from filenames
* validate_plugin_path() - Specialized validation for plugin loading
* validate_download_path() - URL validation before downloads
* safe_extract_archive() - Prevents zip slip attacks during extraction
- Hardened updater.py:
* Added path validation in UpdateDownloadThread.run() (lines ~74-120)
* Added path validation in install_update() (lines ~394-403)
* Sanitized filenames from download URLs
* Switched to safe_extract_archive() for archive handling
- Hardened plugin_manager.py:
* Added plugin path validation in reload_plugins() (lines ~101-127)
* Added URL and archive validation in install_plugin_from_url() (lines ~330-368)
* Integrated safe_extract_archive() to prevent zip slip attacks
S004 - SSL Certificate Verification:
- Added explicit verify=True to requests.get() calls (updater.py line ~92)
- Documented that certifi provides CA bundle for SSL verification
- Verified urllib3/requests use certifi by default
Test Coverage:
- tests/unit/test_security_utils.py: 28 new tests covering all security functions
* Path traversal prevention tests
* Filename sanitization tests
* URL validation tests
* Archive extraction security tests
|
2026-11-07 15:40:47 -07:00 |
|
 tyler
|
3a8ffbdf70
|
mainly whitespace, but also some generic qol improvements
|
2026-10-14 20:17:23 -07:00 |
|
|
tyler
|
2a5e3f5606
|
fix plugins on macOS
|
2026-09-10 13:32:46 -07:00 |
|
|
tyler
|
5d46d3b3e1
|
pylance fixes and terminal plugin launching
|
2026-09-01 21:09:45 -07:00 |
|
|
tyler
|
e9ef78c872
|
continuation of plugin support
|
2026-09-01 17:20:16 -07:00 |
|