dillenberg/ECC
1
0
Fork 0
mirror of https://github.com/Jeuners/ECC.git synced 2026-09-18 02:56:11 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix: harden local dashboard and data boundaries (#2585)

Browse source 
* fix: harden local data boundaries

Bind the capabilities dashboard exclusively to loopback and reject untrusted Host and Origin values. Constrain project-configured agent data paths to the Cursor data root, and harden lifecycle repair/uninstall operations against state-file traversal, symlink swaps, unsafe sources, and forged install-state destinations.\n\nCloses #2506

* fix: eliminate repair source read race

Read source bytes and mode from one no-follow file descriptor so a path replacement cannot mix metadata from one inode with content from another. Add a regression that rejects separate path-based source metadata lookup.

* fix: close dashboard hardening review gaps
This commit is contained in:
Affaan Mustafa 2026-07-27 11:11:29 -07:00 • committed by GitHub
parent 4da6deac18
commit 382060905e
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
10 changed files with 2320 additions and 193 deletions
Download patch file Download diff file Expand all files Collapse all files

6
scripts/lib/loopback-guard.js
View file

@ -15,8 +15,12 @@ function parseHostHeader(value) {
if (!value || typeof value !== 'string') return null;
const trimmed = value.trim();
if (!trimmed) return null;
const match = trimmed.match(/^(\[[^\]]+\]|[^:]+)(?::\d+)?$/);
const match = trimmed.match(/^(\[[^\]]+\]|[^:]+)(?::(\d+))?$/);
if (!match) return null;
if (match[2] !== undefined) {
const port = Number(match[2]);
if (!Number.isInteger(port) || port > 65535) return null;
}
return match[1].toLowerCase();
}