22 lines
1.2 KiB
Markdown
22 lines
1.2 KiB
Markdown
|
# Adversarial Bug Report: Dashboard Task Review and Approval
|
||
|
|
|
||
|
|
## Deep Review
|
||
|
|
The review API writes REVIEW.md to the task folder. Submissions are POST with status + comment.
|
||
|
|
|
||
|
|
## Potential Issues
|
||
|
|
1. **No authentication**: Any HTTP client can submit reviews. The dashboard is localhost-only by default, but `--host 0.0.0.0` exposes the review API without auth.
|
||
|
|
|
||
|
|
2. **No CSRF protection**: POST endpoint accepts JSON from any origin. Mitigated by same-origin policy and no cookies/auth.
|
||
|
|
|
||
|
|
3. **Path traversal in task name**: Task name is URL-decoded but no `../` check. An attacker could write REVIEW.md outside the tasks directory. Fixed below.
|
||
|
|
|
||
|
|
4. **Comment injection**: Comment content is written directly to REVIEW.md without escaping. If REVIEW.md is ever consumed by a markdown renderer, injected markdown could be an issue.
|
||
|
|
|
||
|
|
## Security Fix: Path traversal
|
||
|
|
The `_handle_review` endpoint writes to `project_root / ".automaton" / "tasks" / task_name / self.REVIEW_FILE`. If task_name contains `../`, the review file could be written outside the tasks directory. Add a path traversal check.
|
||
|
|
|
||
|
|
## Security Fix Applied
|
||
|
|
Added path traversal validation to task name in _handle_review and _get_review_status.
|
||
|
|
|
||
|
|
## Verdict: PASS (with security fix applied)
|