gitea-admin/CASAN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: plan 16 P2 batch 1 (SEC-13 SSRF, SEC-27 log-escape, SEC-28 path-traversal)

Browse Source 
- SEC-13 (M-09): SSRF allowlist on provider-usage-fetch (always block non-http(s)
  schemes; enforced mode blocks internal/link-local IPs + non-allowlisted hosts,
  dev keeps loopback mocks); dashboard refuses non-loopback bind in enforced mode.
- SEC-27 (X-02): casan-log strips ESC/CSI + CR/LF (terminal-escape + fake-log-line
  injection) while keeping tab and visible text.
- SEC-28 (X-04): new path-guard.sh — realpath resolve + reject symlink/.. escapes
  outside the allowed root.

Verify: SEC-13 6/0, SEC-27 3/0, SEC-28 4/0, adversarial 44/44, run-casan4 0-FAIL.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
thanhnv
2026-07-06 22:39:18 +09:00
co-authored by Claude Opus 4.8
parent 3432ae59e1
commit 8c06a55aed
11 changed files with 273 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
AINative_OKR_CASAN5/.specify/scripts/bash/ci-harness-gate.sh
+4
View File
@@ -104,6 +104,10 @@ run "phase-sec20-toolchain" bash "$TESTS/phase-sec20-tests.sh"
run "phase-sec21-model-budget" bash "$TESTS/phase-sec21-tests.sh"
run "phase-sec07-approval" bash "$TESTS/phase-sec07-tests.sh"
run "phase-sec10-agent-identity" bash "$TESTS/phase-sec10-tests.sh"
# Plan-16 P2 (depth / hardening)
run "phase-sec13-ssrf" bash "$TESTS/phase-sec13-tests.sh"
run "phase-sec27-log-controlchar" bash "$TESTS/phase-sec27-tests.sh"
run "phase-sec28-path-traversal" bash "$TESTS/phase-sec28-tests.sh"
# ARCH-02: coverage cannot silently drop; ARCH-01: harness/policy cannot silently
# drift. Both SKIP cleanly when no manifest is provisioned (non-strict dev/CI).