Skip to content

v1.1.2 - Safer generation and validation

Latest
Latest

Choose a tag to compare

View all tags
@JoseDFlorez JoseDFlorez released this 09 Oct 00:54
· 2 commits to main since this release
v1.1.2
4910b94

v1.1.2 - Safer generation and validation

Security

  • Validate build and config before writing candidate configurations. Refuse errors and required inconclusive tests; strict mode rejects warnings too.
  • Redact credential previews by default. --include-secrets explicitly enables restricted config output; HTML, Markdown, diagnostic and diff reports retain sanitized previews.
  • Discard values from quarantined imported lines and never re-emit extraConfig.
  • Constrain device IDs and command values, separate optional Cisco hostnames from IDs, check output containment and existing links, and reject case-insensitive filename collisions.
  • Render subnet gateway details through DOM text nodes and select severity/status classes from fixed tokens. The exact Socket XSS was already escaped in v1.1.1; this release strengthens those boundaries and adds permanent regressions.

Reliability and workflow

  • Unknown model fields fail by default. Use validate --relaxed only for incomplete discovery; structural errors still fail and relaxed validation cannot produce configurations.
  • build --allow-invalid creates diagnostic reports without configs. A failed quality gate retains a nonzero exit code.
  • Explicit unsupported CLI platforms, including NX-OS, receive no IOS/ASA commands.
  • IOS and ASA candidates omit automatic saving. Apply, observed verification and persistence are separate actions.
  • Skill instructions distinguish quick answers, labs and audits; label modeled versus observed results and state Packet Tracer .pkt and protocol simulation limits.
  • Regenerate all eight example diagrams and add synchronization checks, regression tools and Windows/Ubuntu CI with Node 22/24.

Migration notes

Correct unknown fields and unsafe IDs, resolve required unknown tests, and replace redacted credentials before applying a lab configuration. For explicitly requested secret-bearing candidates, use config or build --include-secrets and protect the resulting files. Reconstruct needed extraConfig behavior using supported fields; unsupported commands are no longer appended automatically. Regenerate existing HTML to receive the current viewer and sanitized previews.

Validation

The identical 47-test suite passes 25 tests on v1.1.1 and all 47 after these changes. All 21 original toolkit scenarios remain passing. Eight example diagrams are synchronized. Headless Edge reproduces the old vulnerable viewer and blocks the tested attacks in v1.1.1 and the improved viewer, with fixed severity classes in the latter.

Local evidence covers Windows/Node 24 and browser fixtures, not live network devices. CI passed on Windows and Ubuntu with Node 22 and 24. Socket re-audit remains pending. CI run. See the before/after report for raw evidence and limits.

Full changelog: v1.1.1 to v1.1.2.

Assets 2
Loading