mirror of
https://github.com/Jeuners/ECC.git
synced 2026-09-16 10:06:11 +02:00
9661a6f042
* fix(hooks): scrub secrets and harden hook security - Scrub common secret patterns (api_key, token, password, etc.) from observation logs before persisting to JSONL (observe.sh) - Auto-purge observation files older than 30 days (observe.sh) - Strip embedded credentials from git remote URLs before saving to projects.json (detect-project.sh) - Add command prefix allowlist to runCommand — only git, node, npx, which, where are permitted (utils.js) - Sanitize CLAUDE_SESSION_ID in temp file paths to prevent path traversal (suggest-compact.js) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(hooks): address review feedback from CodeRabbit and Cubic - Reject shell command-chaining operators (;|&`) in runCommand, strip quoted sections before checking to avoid false positives (utils.js) - Remove command string from blocked error message to avoid leaking secrets (utils.js) - Fix Python regex quoting: switch outer shell string from double to single quotes so regex compiles correctly (observe.sh) - Add optional auth scheme match (Bearer, Basic) to secret scrubber regex (observe.sh) - Scope auto-purge to current project dir and match only archived files (observations-*.jsonl), not live queue (observe.sh) - Add second fallback after session ID sanitization to prevent empty string (suggest-compact.js) - Preserve backward compatibility when credential stripping changes project hash — detect and migrate legacy directories (detect-project.sh) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(hooks): block $() substitution, fix Bearer redaction, add security tests - Add $ and \n to blocked shell metacharacters in runCommand to prevent command substitution via $(cmd) and newline injection (utils.js) - Make auth scheme group capturing so Bearer/Basic is preserved in redacted output instead of being silently dropped (observe.sh) - Add 10 unit tests covering runCommand allowlist blocking (rm, curl, bash prefixes) and metacharacter rejection (;|&`$ chaining), plus error message leak prevention (utils.test.js) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(hooks): scrub parse-error fallback, strengthen security tests Address remaining reviewer feedback from CodeRabbit and Cubic: - Scrub secrets in observe.sh parse-error fallback path (was writing raw unsanitized input to observations file) - Remove redundant re.IGNORECASE flag ((?i) inline flag already set) - Add inline comment documenting quote-stripping limitation trade-off - Fix misleading test name for error-output test - Add 5 new security tests: single-quote passthrough, mixed quoted+unquoted metacharacters, prefix boundary (no trailing space), npx acceptance, and newline injection - Improve existing quoted-metacharacter test to actually exercise quote-stripping logic Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(security): block $() and backtick inside quotes in runCommand Shell evaluates $() and backticks inside double quotes, so checking only the unquoted portion was insufficient. Now $ and ` are rejected anywhere in the command string, while ; | & remain quote-aware. Addresses CodeRabbit and Cubic review feedback on PR #348. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| agent-harness-construction | ||
| agentic-engineering | ||
| ai-first-engineering | ||
| api-design | ||
| article-writing | ||
| autonomous-loops | ||
| backend-patterns | ||
| clickhouse-io | ||
| coding-standards | ||
| configure-ecc | ||
| content-engine | ||
| content-hash-cache-pattern | ||
| continuous-agent-loop | ||
| continuous-learning | ||
| continuous-learning-v2 | ||
| cost-aware-llm-pipeline | ||
| cpp-coding-standards | ||
| cpp-testing | ||
| database-migrations | ||
| deployment-patterns | ||
| django-patterns | ||
| django-security | ||
| django-tdd | ||
| django-verification | ||
| docker-patterns | ||
| e2e-testing | ||
| enterprise-agent-ops | ||
| eval-harness | ||
| foundation-models-on-device | ||
| frontend-patterns | ||
| frontend-slides | ||
| golang-patterns | ||
| golang-testing | ||
| investor-materials | ||
| investor-outreach | ||
| iterative-retrieval | ||
| java-coding-standards | ||
| jpa-patterns | ||
| liquid-glass-design | ||
| market-research | ||
| nanoclaw-repl | ||
| nutrient-document-processing | ||
| plankton-code-quality | ||
| postgres-patterns | ||
| project-guidelines-example | ||
| python-patterns | ||
| python-testing | ||
| ralphinho-rfc-pipeline | ||
| regex-vs-llm-structured-text | ||
| search-first | ||
| security-review | ||
| security-scan | ||
| skill-stocktake | ||
| springboot-patterns | ||
| springboot-security | ||
| springboot-tdd | ||
| springboot-verification | ||
| strategic-compact | ||
| swift-actor-persistence | ||
| swift-concurrency-6-2 | ||
| swift-protocol-di-testing | ||
| swiftui-patterns | ||
| tdd-workflow | ||
| verification-loop | ||
| visa-doc-translate | ||