- test_long_version_strings: Update expectation for tuple comparison (longer > shorter) - test_path_traversal_prevention: Use tempfile.TemporaryDirectory for cross-platform compatibility - test_normal_join_succeeds: Replace endsWith with contains checks (OS-agnostic) - test_invalid_log_level_defaults_to_info: Verify LOG_LEVEL_ENV_MAP lookup - test_plugin_base_has_abstract_method: Fix ABC type check using ABCMeta instead of isinstance(ABC)
Addresses audit findings S002 (Path Traversal) and S004 (SSL Verification): S002 - Path Traversal Vulnerabilities (CWE-22): - Created src/shared/security_utils.py with centralized security functions: * validate_path_within_root() - Ensures paths stay within allowed directories * safe_join_path() - Safe path joining with traversal detection * sanitize_filename() - Removes dangerous characters from filenames * validate_plugin_path() - Specialized validation for plugin loading * validate_download_path() - URL validation before downloads * safe_extract_archive() - Prevents zip slip attacks during extraction - Hardened updater.py: * Added path validation in UpdateDownloadThread.run() (lines ~74-120) * Added path validation in install_update() (lines ~394-403) * Sanitized filenames from download URLs * Switched to safe_extract_archive() for archive handling - Hardened plugin_manager.py: * Added plugin path validation in reload_plugins() (lines ~101-127) * Added URL and archive validation in install_plugin_from_url() (lines ~330-368) * Integrated safe_extract_archive() to prevent zip slip attacks S004 - SSL Certificate Verification: - Added explicit verify=True to requests.get() calls (updater.py line ~92) - Documented that certifi provides CA bundle for SSL verification - Verified urllib3/requests use certifi by default Test Coverage: - tests/unit/test_security_utils.py: 28 new tests covering all security functions * Path traversal prevention tests * Filename sanitization tests * URL validation tests * Archive extraction security tests
Hermes
Hermes
Hermes
Hermes