Hermes
2d68197272
security: Fix path traversal and add SSL verification hardening
Addresses audit findings S002 (Path Traversal) and S004 (SSL Verification):
S002 - Path Traversal Vulnerabilities (CWE-22):
- Created src/shared/security_utils.py with centralized security functions:
* validate_path_within_root() - Ensures paths stay within allowed directories
* safe_join_path() - Safe path joining with traversal detection
* sanitize_filename() - Removes dangerous characters from filenames
* validate_plugin_path() - Specialized validation for plugin loading
* validate_download_path() - URL validation before downloads
* safe_extract_archive() - Prevents zip slip attacks during extraction
- Hardened updater.py:
* Added path validation in UpdateDownloadThread.run() (lines ~74-120)
* Added path validation in install_update() (lines ~394-403)
* Sanitized filenames from download URLs
* Switched to safe_extract_archive() for archive handling
- Hardened plugin_manager.py:
* Added plugin path validation in reload_plugins() (lines ~101-127)
* Added URL and archive validation in install_plugin_from_url() (lines ~330-368)
* Integrated safe_extract_archive() to prevent zip slip attacks
S004 - SSL Certificate Verification:
- Added explicit verify=True to requests.get() calls (updater.py line ~92)
- Documented that certifi provides CA bundle for SSL verification
- Verified urllib3/requests use certifi by default
Test Coverage:
- tests/unit/test_security_utils.py: 28 new tests covering all security functions
* Path traversal prevention tests
* Filename sanitization tests
* URL validation tests
* Archive extraction security tests
2026-11-07 15:40:47 -07:00
..
2026-11-07 15:14:32 -07:00
2026-11-07 15:28:06 -07:00
2026-11-07 15:28:06 -07:00
2026-11-07 15:40:47 -07:00
2026-11-07 15:14:32 -07:00