gitea-admin/CASAN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: plan 16 P2 batch 1 (SEC-13 SSRF, SEC-27 log-escape, SEC-28 path-traversal)

Browse Source 
- SEC-13 (M-09): SSRF allowlist on provider-usage-fetch (always block non-http(s)
  schemes; enforced mode blocks internal/link-local IPs + non-allowlisted hosts,
  dev keeps loopback mocks); dashboard refuses non-loopback bind in enforced mode.
- SEC-27 (X-02): casan-log strips ESC/CSI + CR/LF (terminal-escape + fake-log-line
  injection) while keeping tab and visible text.
- SEC-28 (X-04): new path-guard.sh — realpath resolve + reject symlink/.. escapes
  outside the allowed root.

Verify: SEC-13 6/0, SEC-27 3/0, SEC-28 4/0, adversarial 44/44, run-casan4 0-FAIL.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
thanhnv
2026-07-06 22:39:18 +09:00
co-authored by Claude Opus 4.8
parent 3432ae59e1
commit 8c06a55aed
11 changed files with 273 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
AINative_OKR_CASAN5/.specify/scripts/bash/casan-log.sh
+5 -1
View File
@@ -24,8 +24,12 @@ casan_log() {
local lvl="$1" comp="$2"
shift 2
[ "$(casan_log_num "$lvl")" -le "$CASAN_LOG_THRESHOLD" ] || return 0
# SEC-27 (X-02): log messages carry attacker-influenced data (action names, tool
# output snippets). Strip control chars — ESC/CSI (terminal-escape injection that
# rewrites a reviewer's screen) and CR/LF (fake-log-line injection) — keeping tab.
local msg; msg="$(printf '%s' "$*" | tr -d '\000-\010\012-\037\177')"
printf '[%s] %s [%s] %s\n' \
"$(printf '%s' "$lvl" | tr '[:lower:]' '[:upper:]')" \
"$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \
"$comp" "$*" >&2
"$comp" "$msg" >&2
}