Lap Tran
4a2301b077
CI / build (push) Has been cancelled
- Archive 79 completed framework-dev tasks from tasks/ -> tasks/complete/ - status.py: add --cleanup-done and --install-cleanup-schedule commands - Add scripts/automaton-cleanup.sh for periodic task archiving - Dashboard: rename 'Background' tab -> 'Agent', 'Cleanup' agent -> 'Completed Task Archiver', remove redundant group headers and pill badges, dim inactive agent placeholders - .rules.md: add Self-Documenting UI Names rule - New tests: test_cleanup_done.py, expanded test_app.py and test_task.py
21 lines
653 B
Markdown
21 lines
653 B
Markdown
# Verdict: Harden Dashboard Security and Fix Scripts
|
|
|
|
## Status: PASS
|
|
**Completion Date**: 2026-06-14
|
|
|
|
## Summary
|
|
Dashboard static file serving now uses a robust path containment check, task names are strictly validated, `update.sh` protects against overwriting local changes, and repository URLs point to the real Gitea instance.
|
|
|
|
## Findings
|
|
- Path traversal check uses `Path.relative_to()`.
|
|
- Task name regex rejects special characters and path separators.
|
|
- `update.sh` aborts on uncommitted changes.
|
|
- README and install script contain the real Gitea URL.
|
|
- Atomic-write guidance added to `.rules.md`.
|
|
|
|
## Remaining Issues
|
|
None.
|
|
|
|
## Score
|
|
+10 PASS
|