Hermes
2d68197272
Addresses audit findings S002 (Path Traversal) and S004 (SSL Verification): S002 - Path Traversal Vulnerabilities (CWE-22): - Created src/shared/security_utils.py with centralized security functions: * validate_path_within_root() - Ensures paths stay within allowed directories * safe_join_path() - Safe path joining with traversal detection * sanitize_filename() - Removes dangerous characters from filenames * validate_plugin_path() - Specialized validation for plugin loading * validate_download_path() - URL validation before downloads * safe_extract_archive() - Prevents zip slip attacks during extraction - Hardened updater.py: * Added path validation in UpdateDownloadThread.run() (lines ~74-120) * Added path validation in install_update() (lines ~394-403) * Sanitized filenames from download URLs * Switched to safe_extract_archive() for archive handling - Hardened plugin_manager.py: * Added plugin path validation in reload_plugins() (lines ~101-127) * Added URL and archive validation in install_plugin_from_url() (lines ~330-368) * Integrated safe_extract_archive() to prevent zip slip attacks S004 - SSL Certificate Verification: - Added explicit verify=True to requests.get() calls (updater.py line ~92) - Documented that certifi provides CA bundle for SSL verification - Verified urllib3/requests use certifi by default Test Coverage: - tests/unit/test_security_utils.py: 28 new tests covering all security functions * Path traversal prevention tests * Filename sanitization tests * URL validation tests * Archive extraction security tests
FLARES (fNIRS Lightweight Analysis, Research, & Evaluation Suite)
FLARES is a lightweight standalone application to extract meaningful data out of .snirf files.
FLARES is free and open-source software that runs on Windows, macOS, and Linux. Please read the information regarding each operating system below.
Visit the official FLARES web site.
For macOS Users
Due to the cost of an Apple Developer account, the application is not certified by Apple. Once the application is extracted and attempted to be launched for the first time you will get a popup stating:
"Apple could not verify flares.app is free of malware that may harm your Mac or compromise your privacy.", with the options of "Done" or "Move to Trash".
The solution around this is to use finder and navigate to the flares-darwin folder. Once the folder has been located, right click the folder and click the option "New Terminal at Folder". Once the terminal opens, run the following command (you can copy + paste):
xattr -dr com.apple.quarantine flares.app & pid1=$!; xattr -dr com.apple.quarantine flares_updater.app & pid2=$!; wait $pid1 $pid2; exit
Once the command has been executed and the text "[Process completed]" appears, you may close the terminal window and attempt to open the application again. If you choose to unrestrict the app through Settings > Privacy & Security, the app may not be able to update correctly in the future.
This only applies for the first time you attempt to run FLARES. Subsequent times, including after updates, will function correctly as-is.
For Windows Users
Due to the cost of a code signing certificate, the application is not digitally signed. Once the application is extracted and attempted to be launched for the first time you will get a popup stating:
"Windows protected your PC - Microsoft Defender SmartScreen prevented an unrecognized app from starting. Running this app might put your PC at risk.", with the options of "More info" or "Don't run".
The solution around this is to click "More info" and then select "Run anyway".
This only applies for the first time you attempt to run FLARES. Subsequent times, including after updates, will function correctly as-is.
For Linux Users
There are no conditions for Linux users at this time.
Licence
FLARES is distributed under the GPL-3.0 license.
Copyright (C) 2025-2026 Tyler de Zeeuw