fix: remediate 9 security findings from external audit (OS-15 through OS-23)#744
Open
johntmyers wants to merge 10 commits intomainfrom
Open
fix: remediate 9 security findings from external audit (OS-15 through OS-23)#744johntmyers wants to merge 10 commits intomainfrom
johntmyers wants to merge 10 commits intomainfrom
Conversation
Prevents CWE-22 path traversal by extracting only the expected APP_NAME member instead of the full archive contents. Adds --no-same-owner and --no-same-permissions for defense-in-depth. OS-20
Wraps username/password values with a yaml_quote helper to prevent YAML injection from special characters in registry credentials (CWE-94). Applied to all three heredoc blocks that emit registries.yaml auth. OS-23
Logs only the last 4 characters of bearer tokens to prevent credential exposure in log aggregation systems (CWE-532). OS-18
Applies html_escape() to the Host/X-Forwarded-Host header value before rendering it into the HTML template, preventing HTML injection (CWE-79). OS-17
… escaping Adds server-side validation rejecting confirmation codes that do not match the CLI-generated format, replaces manual JS string escaping with serde_json serialization (handling U+2028/U+2029 line terminators), and adds a Content-Security-Policy header with nonce-based script-src. OS-16
Prevents resource exhaustion from upstream inference endpoints that stream indefinitely or hold connections open. Adds a 32 MiB total body limit and 30-second per-chunk idle timeout (CWE-400). OS-21
Prevents meaningless port values >65535 from being accepted in policy YAML definitions. The proto field remains uint32 (protobuf has no u16) with validation at the conversion boundary. OS-22
Replaces serde_yaml 0.9 (archived, RUSTSEC-2024-0320) with serde_yml 0.0.12, a maintained API-compatible fork. All import sites updated across openshell-policy, openshell-sandbox, and openshell-router. OS-19
…_count The gateway now re-runs security heuristics on proposed policy chunks instead of trusting sandbox-provided security_notes, validates host wildcards, caps hit_count at 100, and clamps confidence to [0,1]. The TUI approve-all path is updated to use ApproveAllDraftChunks RPC which respects the security_notes filtering gate (CWE-284, confused deputy). OS-15
drew
approved these changes
Apr 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Addresses 9 findings from the external security audit, delivered as one commit per finding for clean bisect/revert:
tarextraction in install.sh to expected binary (path traversal, CWE-22)serde_jsonfor JS embedding, add CSP header (XSS, CWE-79)serde_yamlwithserde_yml(RUSTSEC-2024-0320, CWE-1104)Related Issues
Closes OS-15, OS-16, OS-17, OS-18, OS-19, OS-20, OS-21, OS-22, OS-23
Changes
721f4bdcinstall.shb8307dc7deploy/docker/cluster-entrypoint.sh77541a11crates/openshell-server/src/ssh_tunnel.rs21646778crates/openshell-server/src/auth.rs3c0d7e8dcrates/openshell-server/src/auth.rs1a961133crates/openshell-sandbox/src/proxy.rsf95590f7crates/openshell-policy/src/lib.rs71329fbd04825ee1crates/openshell-server/src/grpc.rs,crates/openshell-tui/src/lib.rsTesting
cargo fmt --check— cleancargo clippy— clean (pre-existing warnings only)cargo test --workspace— all tests pass (new tests added for code validation and port rejection)mise run pre-commit— all checks pass (only pre-existing license header issue on untracked local file)Checklist