chore(security): harden workflows#52
Open
wildduck2 wants to merge 2 commits into
Open
Conversation
SSRF guards on the presigned-POST and multipart strategies, parser hardening across the engine, and slop cleanup. Highlights: - Add shared validateUploadUrl helper and route PostStrategy and the multipart strategy through it. Blocks loopback, RFC 1918, link-local, cloud-metadata, CGNAT, multicast, broadcast, and IPv6-embedded IPv4. - Cap URL length at 8192 bytes, reject `..` segments, http(s) only. - Add allowedHosts and allowPrivateHosts knobs on PostStrategy. - Warn-once when a backend URL is supplied without allowedHosts. - Tighten NaN-bypass defenses in persistence deserializer, validateIntent partSize, calculateFileChecksum cap, and resolveUploadConfig. - Sleep helper now clamps NaN/Infinity/negative input. - Add static-analysis test suite enforcing source-tree invariants. - Rename __test__ to __tests__ for naming consistency. - Add THREAT-MODEL.md (STRIDE+OWASP ASVS) and AUDIT-RESULTS.md. - Trim verbose docstrings and remove non-ascii in production code. Preserves SEC-* security explanations and @template / @author tags.
- SHA-pin every action used across CI/CD (resolves Scorecard
PinnedDependenciesID across 11 workflows)
- Add top-level permissions: contents: read on main and codeql
- main.yml: route github.base_ref / github.event_name through env
vars instead of inline ${{ }} expansion so attacker-controlled
values cannot escape the shell (resolves 2 Semgrep
run-shell-injection)
|
Warning Review limit reached
More reviews will be available in 7 minutes and 13 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (69)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.github/workflows/(resolves ScorecardPinnedDependenciesIDacross 11 workflows).permissions: contents: readonmain.ymlandcodeql.yml.main.yml: passgithub.base_ref/github.event_namevia env vars instead of inline${{ }}expansion inrun:blocks (resolves 2 Semgreprun-shell-injection).Test plan