Hermes
2d68197272
security: Fix path traversal and add SSL verification hardening
...
Addresses audit findings S002 (Path Traversal) and S004 (SSL Verification):
S002 - Path Traversal Vulnerabilities (CWE-22):
- Created src/shared/security_utils.py with centralized security functions:
* validate_path_within_root() - Ensures paths stay within allowed directories
* safe_join_path() - Safe path joining with traversal detection
* sanitize_filename() - Removes dangerous characters from filenames
* validate_plugin_path() - Specialized validation for plugin loading
* validate_download_path() - URL validation before downloads
* safe_extract_archive() - Prevents zip slip attacks during extraction
- Hardened updater.py:
* Added path validation in UpdateDownloadThread.run() (lines ~74-120)
* Added path validation in install_update() (lines ~394-403)
* Sanitized filenames from download URLs
* Switched to safe_extract_archive() for archive handling
- Hardened plugin_manager.py:
* Added plugin path validation in reload_plugins() (lines ~101-127)
* Added URL and archive validation in install_plugin_from_url() (lines ~330-368)
* Integrated safe_extract_archive() to prevent zip slip attacks
S004 - SSL Certificate Verification:
- Added explicit verify=True to requests.get() calls (updater.py line ~92)
- Documented that certifi provides CA bundle for SSL verification
- Verified urllib3/requests use certifi by default
Test Coverage:
- tests/unit/test_security_utils.py: 28 new tests covering all security functions
* Path traversal prevention tests
* Filename sanitization tests
* URL validation tests
* Archive extraction security tests
2026-11-07 15:40:47 -07:00
Hermes
516397dd96
security: Fix command injection vulnerability in updater.py
...
- Add shlex.quote() on all path arguments before subprocess calls (lines 404-407)
- Consolidate duplicated version_compare() function into single module-level utility
- Remove three identical class methods from UpdateCheckThread, LocalPendingUpdateCheckThread, and UpdateManager
- Add comprehensive test suite for updater.py security-critical functionality
- Add requirements-dev.txt with pytest dependency
Addresses critical security findings from flares_audit_report.md:
S001: Command Injection in Updater (CVSS ~7.5)
Q001: Duplicated version_compare logic
T001: Insufficient test coverage for updater.py
2026-11-07 15:14:32 -07:00
tyler
3a8ffbdf70
mainly whitespace, but also some generic qol improvements
2026-10-14 20:17:23 -07:00
tyler
8ef352add3
fix to app not updating
2026-08-31 23:37:12 -07:00
tyler
e37275a1bb
functional connectivity, pylance, and other improvements
2026-08-22 23:38:13 -07:00
tyler
074a0681b9
typos, standardization, and file association for project extensions
2026-08-06 02:00:36 -07:00
tyler
f10eb64332
cleanup what I just did
2026-06-28 09:09:06 -07:00
tyler
617daa0e9b
partial rewrite into multiple files
2026-06-28 08:57:38 -07:00
tyler
766bf75dd7
massive changes for 1.5.0
2026-06-28 08:17:36 -07:00
tyler
91fb9b38d4
copyright
2026-03-13 16:55:49 -07:00
tyler
c279f269da
update logic seperated and blazes import
2026-03-13 13:00:57 -07:00
Hermes
tyler