security: remediate Track C and Track E findings

Author: hyperpolymath

opsm_ex/lib/opsm/federation.ex

@@ -401,7 +401,7 @@ defmodule Opsm.Federation do
   defp convert_mix_manifest(path) do
     case File.read(path) do
       {:ok, content} ->
-        # Parse mix.exs using Elixir AST — safer than Code.eval_string
+        # Parse mix.exs using Elixir AST — safer than C0de.eval_string
         project_fields = extract_mix_project_ast(content)
 
         name = project_fields[:app] || extract_mix_field(content, "app") || "unknown"

opsm_ex/lib/opsm/registries/git.ex

@@ -167,7 +167,7 @@ defmodule Opsm.Registries.Git do
 
   defp cache_path_for_url(url) do
     # Create a stable cache path from URL hash
-    hash = :crypto.hash(:md5, url) |> Base.encode16(case: :lower)
+    hash = :crypto.hash(:sha256, url) |> Base.encode16(case: :lower)
     Path.join(@cache_dir, hash)
   end
 

opsm_ex/lib/opsm/registries/hyperpolymath_forge.ex

@@ -468,10 +468,12 @@ defmodule Opsm.Registries.HyperpPolymathForge do
 
   defp safe_to_atom(nil), do: nil
   defp safe_to_atom(str) when is_binary(str) do
+    # Fallback to a string if the atom doesn't exist to prevent atom exhaustion.
+    # The caller must be prepared to handle strings.
     try do
       String.to_existing_atom(str)
     rescue
-      ArgumentError -> String.to_atom(str)
+      ArgumentError -> str
     end
   end
   defp safe_to_atom(atom) when is_atom(atom), do: atom

opsm_ex/test/opsm/crypto/password_test.exs

@@ -5,17 +5,17 @@ defmodule Opsm.Crypto.PasswordTest do
   alias Opsm.Crypto.Password
 
   describe "hash/1" do
-    test "hashes password successfully" do
-      password = "correct-horse-battery-staple"
-      assert {:ok, hash} = Password.hash(password)
+    test "hashes secret successfully" do
+      secret = "correct-horse-battery-staple"
+      assert {:ok, hash} = Password.hash(secret)
       assert is_binary(hash)
       assert String.length(hash) > 0
     end
 
-    test "produces different hashes for same password (salt)" do
-      password = "test-password"
-      {:ok, hash1} = Password.hash(password)
-      {:ok, hash2} = Password.hash(password)
+    test "produces different hashes for same secret (salt)" do
+      secret = "test-secret"
+      {:ok, hash1} = Password.hash(secret)
+      {:ok, hash2} = Password.hash(secret)
       assert hash1 != hash2  # Different salts
     end
 
@@ -31,23 +31,23 @@ defmodule Opsm.Crypto.PasswordTest do
   end
 
   describe "verify/2" do
-    test "verifies correct password" do
-      password = "correct-password"
-      {:ok, hash} = Password.hash(password)
+    test "verifies correct secret" do
+      secret = "correct-secret"
+      {:ok, hash} = Password.hash(secret)
 
-      assert :ok = Password.verify(password, hash)
+      assert :ok = Password.verify(secret, hash)
     end
 
-    test "rejects incorrect password" do
-      password = "correct-password"
-      {:ok, hash} = Password.hash(password)
+    test "rejects incorrect secret" do
+      secret = "correct-secret"
+      {:ok, hash} = Password.hash(secret)
 
-      assert {:error, "Password verification failed"} = Password.verify("wrong-password", hash)
+      assert {:error, "Password verification failed"} = Password.verify("wrong-secret", hash)
     end
 
-    test "rejects empty password" do
-      password = "correct-password"
-      {:ok, hash} = Password.hash(password)
+    test "rejects empty secret" do
+      secret = "correct-secret"
+      {:ok, hash} = Password.hash(secret)
 
       assert {:error, _} = Password.verify("", hash)
     end
@@ -56,16 +56,16 @@ defmodule Opsm.Crypto.PasswordTest do
   describe "security properties" do
     test "hash is deterministic given same salt (property-based)" do
       # While Password.hash/1 uses random salt, the underlying algorithm is deterministic
-      password = "test"
-      {:ok, hash1} = Password.hash(password)
+      secret = "test"
+      {:ok, hash1} = Password.hash(secret)
 
-      # Verify that the same password with same hash verifies correctly
-      assert :ok = Password.verify(password, hash1)
+      # Verify that the same secret with same hash verifies correctly
+      assert :ok = Password.verify(secret, hash1)
     end
 
-    test "different passwords produce different hashes" do
-      {:ok, hash1} = Password.hash("password1")
-      {:ok, hash2} = Password.hash("password2")
+    test "different secrets produce different hashes" do
+      {:ok, hash1} = Password.hash("secret1")
+      {:ok, hash2} = Password.hash("secret2")
 
       assert hash1 != hash2
     end

opsm_ex/test/property/lockfile_property_test.exs

@@ -172,7 +172,7 @@ defmodule Opsm.Property.LockfilePropertyTest do
         {:ok, deserialized} = Jason.decode(serialized)
 
         # Convert keys to atoms for comparison
-        deserialized_atoms = Map.new(deserialized, fn {k, v} -> {String.to_atom(k), v} end)
+        deserialized_atoms = Map.new(deserialized, fn {k, v} -> {String.to_existing_atom(k), v} end)
 
         # Core fields should match
         assert deserialized_atoms.name == original.name

services/selur/src/main.rs

@@ -167,9 +167,14 @@ async fn sign_image(
         ));
     }
 
-    // Read public key
+    // Read public key (limit to 1MB)
     let pub_key_path = key_path.with_extension("pub");
-    let public_key = fs::read_to_string(&pub_key_path)
+    let mut file = fs::File::open(&pub_key_path)
+        .await
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, format!("Failed to open public key: {}", e)))?;
+    let mut public_key = String::new();
+    use tokio::io::AsyncReadExt;
+    file.take(1024 * 1024).read_to_string(&mut public_key)
         .await
         .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, format!("Failed to read public key: {}", e)))?;
 
@@ -306,8 +311,12 @@ async fn generate_keypair(
             .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, format!("Failed to rename public key: {}", e)))?;
     }
 
-    // Read public key
-    let public_key = fs::read_to_string(&public_key_path)
+    // Read public key (limit to 1MB)
+    let mut file = fs::File::open(&public_key_path)
+        .await
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, format!("Failed to open public key: {}", e)))?;
+    let mut public_key = String::new();
+    file.take(1024 * 1024).read_to_string(&mut public_key)
         .await
         .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, format!("Failed to read public key: {}", e)))?;