thanhnvandClaude Opus 4.8
8c06a55aed
- SEC-13 (M-09): SSRF allowlist on provider-usage-fetch (always block non-http(s) schemes; enforced mode blocks internal/link-local IPs + non-allowlisted hosts, dev keeps loopback mocks); dashboard refuses non-loopback bind in enforced mode. - SEC-27 (X-02): casan-log strips ESC/CSI + CR/LF (terminal-escape + fake-log-line injection) while keeping tab and visible text. - SEC-28 (X-04): new path-guard.sh — realpath resolve + reject symlink/.. escapes outside the allowed root. Verify: SEC-13 6/0, SEC-27 3/0, SEC-28 4/0, adversarial 44/44, run-casan4 0-FAIL. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
36 lines
1.2 KiB
Bash
36 lines
1.2 KiB
Bash
#!/usr/bin/env bash
|
|
# CASAN shared log helper (source me, do not execute).
|
|
# Taxonomy (shared with scripts/casan-log.mjs): error < warn < info < debug < trace.
|
|
# CASAN_LOG_LEVEL selects the threshold (default: info). All log lines go to
|
|
# stderr so stdout contracts (CASAN_HARNESS_COMPLETE, cache=..., evidence
|
|
# .stdout files) stay byte-identical.
|
|
|
|
casan_log_num() {
|
|
case "$1" in
|
|
error) echo 0 ;;
|
|
warn) echo 1 ;;
|
|
info) echo 2 ;;
|
|
debug) echo 3 ;;
|
|
trace) echo 4 ;;
|
|
*) echo 2 ;;
|
|
esac
|
|
}
|
|
|
|
CASAN_LOG_LEVEL="${CASAN_LOG_LEVEL:-info}"
|
|
CASAN_LOG_THRESHOLD="$(casan_log_num "$CASAN_LOG_LEVEL")"
|
|
|
|
# casan_log <level> <component> <message...>
|
|
casan_log() {
|
|
local lvl="$1" comp="$2"
|
|
shift 2
|
|
[ "$(casan_log_num "$lvl")" -le "$CASAN_LOG_THRESHOLD" ] || return 0
|
|
# SEC-27 (X-02): log messages carry attacker-influenced data (action names, tool
|
|
# output snippets). Strip control chars — ESC/CSI (terminal-escape injection that
|
|
# rewrites a reviewer's screen) and CR/LF (fake-log-line injection) — keeping tab.
|
|
local msg; msg="$(printf '%s' "$*" | tr -d '\000-\010\012-\037\177')"
|
|
printf '[%s] %s [%s] %s\n' \
|
|
"$(printf '%s' "$lvl" | tr '[:lower:]' '[:upper:]')" \
|
|
"$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \
|
|
"$comp" "$msg" >&2
|
|
}
|