gitea-admin/CASAN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: plan 16 P2 batch 1 (SEC-13 SSRF, SEC-27 log-escape, SEC-28 path-traversal)

Browse Source 
- SEC-13 (M-09): SSRF allowlist on provider-usage-fetch (always block non-http(s)
  schemes; enforced mode blocks internal/link-local IPs + non-allowlisted hosts,
  dev keeps loopback mocks); dashboard refuses non-loopback bind in enforced mode.
- SEC-27 (X-02): casan-log strips ESC/CSI + CR/LF (terminal-escape + fake-log-line
  injection) while keeping tab and visible text.
- SEC-28 (X-04): new path-guard.sh — realpath resolve + reject symlink/.. escapes
  outside the allowed root.

Verify: SEC-13 6/0, SEC-27 3/0, SEC-28 4/0, adversarial 44/44, run-casan4 0-FAIL.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
thanhnv
2026-07-06 22:39:18 +09:00
co-authored by Claude Opus 4.8
parent 3432ae59e1
commit 8c06a55aed
11 changed files with 273 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
AINative_OKR_CASAN5/.specify/scripts/bash/dashboard-server.py
+7
View File
@@ -77,4 +77,11 @@ BIND = os.environ.get("CASAN_DASHBOARD_BIND", "127.0.0.1")
if __name__ == "__main__":
# SEC-13 (M-09): the dashboard has no auth, so binding to all interfaces exposes
# it to the network. In enforced mode refuse a non-loopback bind (fail-closed);
# a real deployment must front it with TLS + auth (Plan-07 TIER 2), not 0.0.0.0.
_enforced = os.environ.get("CASAN_PROFILE") == "prod" or os.environ.get("CASAN_DASHBOARD_STRICT") == "1"
if _enforced and BIND not in ("127.0.0.1", "::1", "localhost"):
sys.stderr.write(f"DASHBOARD_BIND_REFUSED bind={BIND} (loopback only in enforced mode)\n")
raise SystemExit(1)
HTTPServer((BIND, PORT), Handler).serve_forever()