Hermes
2d68197272
Addresses audit findings S002 (Path Traversal) and S004 (SSL Verification): S002 - Path Traversal Vulnerabilities (CWE-22): - Created src/shared/security_utils.py with centralized security functions: * validate_path_within_root() - Ensures paths stay within allowed directories * safe_join_path() - Safe path joining with traversal detection * sanitize_filename() - Removes dangerous characters from filenames * validate_plugin_path() - Specialized validation for plugin loading * validate_download_path() - URL validation before downloads * safe_extract_archive() - Prevents zip slip attacks during extraction - Hardened updater.py: * Added path validation in UpdateDownloadThread.run() (lines ~74-120) * Added path validation in install_update() (lines ~394-403) * Sanitized filenames from download URLs * Switched to safe_extract_archive() for archive handling - Hardened plugin_manager.py: * Added plugin path validation in reload_plugins() (lines ~101-127) * Added URL and archive validation in install_plugin_from_url() (lines ~330-368) * Integrated safe_extract_archive() to prevent zip slip attacks S004 - SSL Certificate Verification: - Added explicit verify=True to requests.get() calls (updater.py line ~92) - Documented that certifi provides CA bundle for SSL verification - Verified urllib3/requests use certifi by default Test Coverage: - tests/unit/test_security_utils.py: 28 new tests covering all security functions * Path traversal prevention tests * Filename sanitization tests * URL validation tests * Archive extraction security tests
Test Suite
This directory contains automated tests for the FLARES project.
Directory Structure
tests/
├── unit/ # Unit tests for individual modules
│ ├── test_updater.py # Security-critical updater module tests
│ └── ... (more tests TBD)
├── integration/ # Integration tests for multi-component workflows
└── fixtures/ # Test data and mock resources
Running Tests
# Install development dependencies
pip install -r requirements-dev.txt
# Run all unit tests
pytest tests/unit/ -v
# Run specific test file
pytest tests/unit/test_updater.py -v
# Run with coverage
pytest --cov=src tests/ -v
Test Coverage Goals
updater.py: 100% (security-critical)- Core modules: >80%
- Overall project: >60% (initial target)
Writing Tests
See existing tests in tests/unit/test_updater.py for examples of:
- Testing utility functions like
version_compare() - Mocking external dependencies (QThread, HTTP requests)
- Security-focused test cases