czlonkowski
|
b106550520
|
security: fix CRITICAL timing attack and command injection vulnerabilities (Issue #265)
This commit addresses 2 critical security vulnerabilities identified in the
security audit.
## CRITICAL-02: Timing Attack Vulnerability (CVSS 8.5)
**Problem:** Non-constant-time string comparison in authentication allowed
timing attacks to discover tokens character-by-character through statistical
timing analysis (estimated 24-48 hours to compromise).
**Fix:** Implemented crypto.timingSafeEqual for all token comparisons
**Changes:**
- Added AuthManager.timingSafeCompare() constant-time comparison utility
- Fixed src/utils/auth.ts:27 - validateToken method
- Fixed src/http-server-single-session.ts:1087 - Single-session HTTP auth
- Fixed src/http-server.ts:315 - Fixed HTTP server auth
- Added 11 unit tests with timing variance analysis (<10% variance proven)
## CRITICAL-01: Command Injection Vulnerability (CVSS 8.8)
**Problem:** User-controlled nodeType parameter injected into shell commands
via execSync, allowing remote code execution, data exfiltration, and network
scanning.
**Fix:** Eliminated all shell execution, replaced with Node.js fs APIs
**Changes:**
- Replaced execSync() with fs.readdir() in enhanced-documentation-fetcher.ts
- Added multi-layer input sanitization: /[^a-zA-Z0-9._-]/g
- Added directory traversal protection (blocks .., /, relative paths)
- Added path.basename() for additional safety
- Added final path verification (ensures result within expected directory)
- Added 9 integration tests covering all attack vectors
## Test Results
All Tests Passing:
- Unit tests: 11/11 ✅ (timing-safe comparison)
- Integration tests: 9/9 ✅ (command injection prevention)
- Timing variance: <10% ✅ (proves constant-time)
- All existing tests: ✅ (no regressions)
## Breaking Changes
None - All changes are backward compatible.
## References
- Security Audit: Issue #265
- Implementation Plan: docs/local/security-implementation-plan-issue-265.md
- Audit Analysis: docs/local/security-audit-analysis-issue-265.md
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
|
2025-10-06 14:09:06 +02:00 |
|