Skip to content

v2.16.0 - CodeQL Security Hardening & Zero-Vulnerability Milestone

Choose a tag to compare

View all tags
@spelech spelech released this 27 Sep 12:13
· 6 commits to main since this release
v2.16.0
970e674

ContextCortex v2.16.0 Release Notes

馃敀 Security Hardening (CodeQL 0-Alert Milestone)

  • Path Traversal / Path Injection Prevention (CWE-22/CWE-73):
    • Enforced rigorous path confinement across local storage, PDF extractors, ADR generation, file reader services, and indexing pipelines.
    • Confined vector store paths (ChromaDB, Qdrant) to explicitly authorized directories (DATA_DIR, /app/data, data/, /tmp).
    • Removed raw filesystem open fallbacks in summarization services.
  • SSRF Prevention (CWE-918):
    • Validated model discovery and LiteLLM URLs with scheme whitelisting (http, https) and private/internal IP blocking.
  • Information Exposure & Stack Trace Sanitization (CWE-209):
    • Sanitized error disclosures across all REST API routers (settings, storage, repositories, navigator, graph, ingestion, webhooks).
    • Exceptions logged securely server-side while clients receive sanitized generic error envelopes.
  • Sensitive Data & Credential Protection (CWE-312 / CWE-916):
    • Redacted token prefixes and secrets in key management logs.
    • Migrated API key hashing from raw SHA-256 to PBKDF2 HMAC-SHA256 with cryptographically secure per-key salts.
  • ReDoS Prevention (CWE-1333):
    • Hardened API route extractor regular expressions against catastrophic backtracking.
Assets 2
Loading