Repository navigation
fix findings from the casa security self-check - #147
Merged
Merged
Conversation
Only the web app's files had nosniff, a referrer policy and a framing rule; the api's JSON, its redirects and its 404s had none, and Express announced itself. Set them once in front of everything, deny framing everywhere (nothing frames the web app) with frame-ancestors as well, and add HSTS where APP_URL is https, since neither Render nor Caddy sends it.
The docs and the website are static sites on Render, which adds none of nosniff, a referrer policy, a framing rule or HSTS. Set them in the blueprint, as the app sets them itself.
Without authTagLength, node's decipher takes a tag as short as four bytes, which is far easier to forge; Bun already refuses one, so this states the rule instead of relying on the runtime, and a test keeps it. Flagged by semgrep's gcm-no-tag-length.
…en request decodeURIComponent throws on a malformed percent sequence, which escaped the Do block and became a 500 with a logged stack. Treat it as no credentials, so the client gets invalid_client.
properties[key] found constructor and toString on the prototype, so a tool appeared to take them; parseRecordValues refused them later, but the check meant to say which params a tool takes should say it itself.
imapflow reaches it through socks, as does the shadcn cli. 10.7.4 fixes GHSA-rxp7-6hxx-x8q5 and is within the range both ask for.
Removing a member, or their leaving or deleting their account, left the shared agents they made as they were: they had seen each one's password, so they could still sign in as it and use every shared connection with it until someone reset it by hand. Give those agents a password nobody knows and end their sessions as the member goes; the agents stay, the MCP clients other members signed in with them keep working, and the owner hands them a new password to sign in with again.
…a read The check for a second statement read quotes and comments its own way, which neither database does: Postgres ends 'x\' at the backslash and has $tag$ strings, and MySQL has # comments. So a query like SELECT 'x\'; COMMIT; DELETE FROM users; --' passed as one statement, the COMMIT ended the read-only transaction, and the DELETE ran, with only Run queries allowed. Refuse any semicolon but the trailing ones instead: no statement follows another without one, and an agent can write a query without a semicolon in its strings.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security self-check for Google's CASA assessment (AL1), run again on today's main, which has moved a long way since #86. It covers the repository only: no requests were made to the hosted service, and DAST is left for a staging instance. This replaces #86.
Scanned with
p/owasp-top-ten,p/typescript,p/nodejs,p/secrets, plusp/default,p/react,p/jwt. 14 findings: one fixed here (gcm-no-tag-length). The rest are mutable action tags in CI (filed) or false positives: regexes built from literal tag and attribute names, a fixedindex.htmlforsendFile, a test fixture and a setup script..env.example, PostHog's public ingestion key, old mock data and local build caches. Nothing new on this branch.bun audit: two transitive advisories. ip-address is fixed here. deepmerge-ts 7.1.5 is pinned by@prisma/configand needs Prisma 7;html-to-textalready gets 8.0.2.Fixed here
'x\'at the backslash and has$tag$strings, and MySQL has#comments. SoSELECT 'x\'; COMMIT; DELETE FROM users; --'passed as one statement, theCOMMITended the read-only transaction, and theDELETEran. Any semicolon before the trailing ones is now refused.nosniff,Referrer-Policy,X-Frame-Options: DENY,frame-ancestors 'none'and, over https, HSTS on every response. It also stops sendingX-Powered-By. The docs and the website get the same headers fromrender.yaml./oauth/tokennow getsinvalid_clientinstead of a 500.constructor.socksasks for.Already on main since #86, so dropped from here: Google sign-in's tokens are no longer stored, human session tokens are hashed at rest (#125), and accounts can be deleted in the app (#108).
Filed for later
__Secure-session cookie over https, ideally as__Host-/oauth/authorizerequests from a client that never completed a grant: anyone can register a client, so today it is an open redirectAgentSession.userId, so signing out a member can also end sessions they opened on shared agents they didn't makeTypecheck, lint, build and all 1,175 tests pass. The member removal change was also checked against the local database.
Open workspace in Conductor