Skip to content

v0.1.2

Choose a tag to compare

View all tags
@axeldunkel axeldunkel released this 05 Apr 14:42
· 90 commits to main since this release
v0.1.2
15beea4
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security hardening for untrusted DADL specs and upstream servers, plus a big test coverage push.

Security & Hardening (#41)

  • SSRF protection for REST backends: base URLs and redirect targets are now validated against private/loopback/link-local/cloud-metadata addresses at both config load and connection time, preventing DNS rebinding. A test-only hook (allowPrivateBaseURL) keeps local httptest servers usable.
  • Sandbox lockdown for composite JS: Function.prototype.constructor is frozen to block prototype-chain bypasses. The static scanner now walks class bodies, static blocks, and tagged template literals to catch forbidden identifiers (fetch, require, process, …).
  • OAuth 2.1 hardening: client_id is now verified in both authorization_code and refresh_token grants; mismatches return invalid_grant.
  • HTTP server hardening: new SecurityHeaders (X-Content-Type-Options, X-Frame-Options) and PanicRecovery middleware. /mcp enforces Content-Type: application/json and a 10 MB body cap. clientIP walks X-Forwarded-For right-to-left and skips private IPs to prevent spoofing.
  • CORS: wildcard matching (*.example.com) now requires a proper subdomain boundary — evil-example.com is correctly rejected. Access-Control-Allow-Credentials is only set for explicitly allow-listed origins.
  • Blob store: files are written with 0600 permissions, served with X-Content-Type-Options: nosniff and Cache-Control: private, no-store, and IDs containing / are rejected to block path traversal.
  • DADL error/transform limits: jq transforms are capped at 100k results and 10 MB output; error messages truncated at 1 KB.
  • Executor: sensitive parameter names (password, token, api_key, …) are now redacted in debug logs, not just in the audit store.

Testing (#42)

Overall go test -cover ./... restored from 51.2% → 80.0%. 48 new test files across all internal packages. Unit tests only — no integration tests, no real network calls, no new dependencies.

Package Before After
internal/blob 0.0% 83.8%
internal/backend 42.8% 80.6%
internal/authz 23.5% 88.2%
internal/credentials 30.8% 100.0%
internal/dadl 47.5% 87.8%
internal/composite 53.8% 87.6%
internal/mcp 63.1% 81.0%
internal/auth 43.6% 82.2%
internal/executor 70.7% 83.7%
internal/tsdef 74.2% 90.3%

Full Changelog: v0.1.1...v0.1.2

Assets 2
Loading