🛡️ Sentinel: Fix configuration injection and improve input validation#93
Conversation
This commit addresses several security concerns: 1. Fixes a TOML injection vulnerability in `scripts/rename.py` by properly escaping backslashes and double quotes. 2. Adds strict regex validation for `github` and `email` fields in the setup script. 3. Implements length limits (100 chars) and blocks control characters in both the CLI and the setup script to mitigate DoS and terminal/ANSI injection risks. 4. Adds a security journal at `.jules/sentinel.md` to document these findings.
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
As requested, I've reverted the input validation changes in `project/app.py`. The security improvements in `scripts/rename.py` (proper TOML escaping and input validation) remain, along with the Sentinel journal.
1 participant
I have implemented several security enhancements to the codebase as part of my Sentinel mission:
1. Fixed Configuration Injection in
scripts/rename.pyThe project initialization script was vulnerable to TOML injection because it failed to escape backslashes in user-provided fields. An attacker could use a trailing backslash to escape the closing quote of a string in
pyproject.toml, potentially leading to corrupted configuration or line injection. I've added a propertoml_escapefunction and applied it to all relevant fields.2. Enhanced Input Validation
3. Sentinel Journal
Created
.jules/sentinel.mdto document the configuration injection pattern found in the template script for future reference and prevention.All changes are under 50 lines per file and have been verified with reproduction scripts, the full test suite, and the
rufflinter.PR created automatically by Jules for task 17696590722368959756 started by @amrabed