copilot-swe-agent[bot]
1a195a96bd
- Merge origin/main into branch (resolve conflict in integrations_dashboard.html) - Add defensive JSON parsing with try/except for integration.config - Wrap tester() call in try/except to prevent 500 errors from bad config - Add i18n key integrations.connection_test_failed_fallback in en.json - Reference i18n key in template JS fallback message - Update SECURITY_AUDIT.md: add fix date (2026-03-23), update doc date - Remove accidental revert.sh file - Fix missing MagicMock/patch imports in test file - Add tests for invalid JSON config and tester exception error paths Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com> Agent-Logs-Url: https://github.com/christianlouis/DocuElevate/sessions/daebb70e-059a-4601-8864-88eef49f99cf
1.9 KiB
2026-03-20 - Safe Path Traversal Prevention in Low-Level Utilities
Vulnerability: The generic file utility hash_file in app/utils/file_operations.py accepted any file path and was vulnerable to reading arbitrary files via path traversal (e.g., ../../../etc/passwd) or absolute paths if an attacker could control the filepath argument.
Learning: Naively checking for ".." in path breaks legitimate relative paths used internally by the application. Blocking absolute paths entirely also breaks functionality. Input validation should occur at the API boundary, but for defense-in-depth, low-level utilities must enforce expected boundaries (e.g., the application's workdir).
Prevention: Use pathlib.Path.resolve() on both the target path and the allowed base directory (settings.workdir). Ensure the resolved target path is strictly within the allowed boundary using filepath_obj.relative_to(workdir_obj), catching the ValueError that is raised when the path is out of bounds. This safely blocks both relative traversal attacks and arbitrary absolute paths.
2025-05-18 - [SSRF Bypass via DNS Resolution Failure]
Vulnerability: The is_private_ip function in app/utils/network.py failed open (returned False) when a hostname could not be resolved (socket.gaierror).
Learning: This fail-open pattern was originally added to allow external domains in tests, but in production, it created a severe SSRF risk. An attacker could bypass SSRF protections by providing a URL that fails to resolve during the security check but resolves later (DNS rebinding), or by exploiting internal routing behaviors via unresolvable addresses.
Prevention: Always fail securely in network authorization functions. If a domain cannot be resolved to verify its safety, the request must be blocked (return True / default-deny). Tests should mock DNS resolution correctly instead of compromising production security logic.