25 lines
1.3 KiB
Markdown
25 lines
1.3 KiB
Markdown
|
# Implementation: Harden Dashboard Security and Fix Scripts
|
||
|
|
|
||
|
|
## Summary
|
||
|
|
Closed security holes in the dashboard static file serving and tightened task name validation. Fixed `update.sh` to warn about uncommitted changes. Replaced placeholder URLs with the real Gitea repository URL. Added artifact integrity guidance.
|
||
|
|
|
||
|
|
## Files Changed
|
||
|
|
- `automaton/dashboard/ui/app.py`
|
||
|
|
- Replaced string-prefix path traversal check with robust `Path.relative_to()` resolution.
|
||
|
|
- Tightened task name validation to allow only `[A-Za-z0-9_-]+`.
|
||
|
|
- Added `import re`.
|
||
|
|
- `tests/test_app.py` — added symlink path-traversal test and static-file happy-path test.
|
||
|
|
- `scripts/update.sh` — added uncommitted-changes check before `git pull`.
|
||
|
|
- `README.md` — replaced placeholder install URL with `http://10.37.0.86:3003/hermes/automaton`.
|
||
|
|
- `scripts/install.sh` — replaced placeholder clone URL with `http://10.37.0.86:3003/hermes/automaton`.
|
||
|
|
- `.rules.md` — added "Artifact Integrity" section with atomic-write guidance.
|
||
|
|
|
||
|
|
## Verification
|
||
|
|
- `python -m pytest tests/` passes: **72 tests passed**.
|
||
|
|
- `bash -n scripts/update.sh` passes.
|
||
|
|
- `bash -n scripts/install.sh` passes.
|
||
|
|
|
||
|
|
## Decisions
|
||
|
|
- Task names are restricted to kebab-case/alphanumeric to prevent filesystem traversal.
|
||
|
|
- Symlinks escaping `html_dir` are rejected with 403.
|