Repository navigation
ci: security static analysis (Sobelow, CodeQL) and dependency scanning - #15
Merged
Merged
Conversation
The lookup cache keeps each model answer as an Erlang term in the server's own database. Reading it back used binary_to_term with :safe, which stops new atoms but still accepts a function. A row changed on disk could then hand the server a function as part of an answer. The cache now reads entries with Plug.Crypto.non_executable_binary_to_term (and :safe), so such a row is a cache miss. plug_crypto already came with plug; it is now a direct dependency because the server calls it. A regression test plants a function in a cache row and expects a miss. Found by Sobelow (Misc.BinToTerm, high confidence). Nothing from the network reaches this call, so it was hardening, not an exploitable bug. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Ayla Croft <dev@scriptkittyos.com>
Sobelow is a security analyser for Elixir. It looks for SQL and command injection, path traversal, unsafe binary_to_term, atom exhaustion and insecure settings. It now runs in CI's server job (newest Elixir) and fails on any finding, at any confidence. Kotiko is a plain Plug app, so server/.sobelow-conf sets router: :none: the Phoenix router checks have nothing to read, and the other checks still run. It also scans the mix tasks, migrations and scripts, fails if a file can't be parsed, and makes no network requests. The first scan found one real issue, fixed in the previous commit, and 23 low-confidence path traversal findings in 17 functions. Every one is a file call whose path comes from the server's own settings (the data folder, the token file, backups, the model list cache) or from an operator's command line (mix kotiko.import, mix kotiko.export, the .env file). None takes a path from a request. Each of those functions now carries a sobelow_skip comment under a line saying why, so a new file call anywhere else still fails CI. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Ayla Croft <dev@scriptkittyos.com>
OSV-Scanner checks the three lockfiles (the dev tools, the docs site and the server's mix.lock) against the OSV database, which also lists malicious packages. It runs on every pull request and push to main, every Monday, and from the release workflow: a release isn't built when the scan fails. Any known vulnerability fails it, at any severity, unless osv-scanner.toml accepts it with a reason and an expiry date. OSV-Scanner over npm audit: one tool covers both npm lockfiles and mix.lock, it needs no node_modules, and accepted findings expire on their own. The dependency review action only sees what a pull request changes, so it can't check a release. The binary is a pinned release checked against its SHA-256, like gitleaks. The scan is a reusable workflow, so the release runs the same check with the same pin. mix deps.audit and mix hex.audit stay in CI. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Ayla Croft <dev@scriptkittyos.com>
The site has its own package.json and lockfile in site/, which Dependabot didn't watch. It now opens weekly updates for them, grouped like the others. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Ayla Croft <dev@scriptkittyos.com>
CodeQL, GitHub's security analyser, now checks the JavaScript (the extension, scripts, tests and docs site) and the GitHub Actions workflows (script injection, untrusted checkouts, token permissions) with the security-extended queries. It runs on every pull request and push to main, and every Monday. Results go to the Security tab and the "Code scanning results" check. Both languages are analysed from source, so there is nothing to build. The action is pinned by commit SHA. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Ayla Croft <dev@scriptkittyos.com>
What the dependency scans and the security analysers check, what blocks a merge or a release, how fast a finding is fixed (the same targets as a reported vulnerability), how a finding that can't be exploited is accepted and where that is recorded, and the licenses a runtime dependency may have. SECURITY.md and CONTRIBUTING.md link to it. The assurance case now names OSV-Scanner and Sobelow, and the lookup cache's safer decoding. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Ayla Croft <dev@scriptkittyos.com>
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Security static analysis and dependency scanning in CI. This is for silver
static_analysis_common_vulnerabilitiesand Baselineosps_vm_05_01/05_02/05_03andosps_vm_06_01/06_02.server/.sobelow-conf. It usesrouter: :none, Sobelow's mode for plain Plug apps: the Phoenix-only CSRF/CSP/header checks are skipped, and every injection, traversal and deserialization check still runs.Plug.Crypto.non_executable_binary_to_term/2. A regression test plants a function in a cache row and expects a miss; it fails without the fix. Only the server writes that column, so this wasn't exploitable.codeql.yml):actionsandjavascript-typescript,security-extendedqueries, on PRs, pushes to main and weekly. Pinned by SHA, with minimal permissions.dependency-scan.yml, the binary checked against its SHA-256) scans all three lockfiles on PRs, pushes and weekly.osv-scanner.toml, each with a reason and an expiry date.site/.docs/security/dependency-and-static-analysis-policy.md, linked from SECURITY.md and CONTRIBUTING.md. It covers severities, what blocks a merge or a release, fix deadlines, how an unreachable finding is accepted, and a dependency license list.For the maintainer
osv-scannerand CodeQL (a "Require code scanning results" rule, or theanalyze (…)checks) to themainruleset's required checks.sobelow-0.15.0mix archive shadows the project's 0.16;mix archive.uninstall sobelowremoves it.Checked
npm run lint,npm test(1873),check-versionsandreuse lintpass.mix format,compile --warnings-as-errors,credo,hex.audit,deps.auditanddeps.unlock --check-unusedpass.mix test: 1001 tests, 0 failures.mix sobelowexits 0, and planted findings make it exit 1.*_FILEsecrets). PR feat(server): secrets from files, XDG folders and an uninstall #13 now carries its justified skip, and the combined tree scans clean.🤖 Generated with Claude Code