Ryan Malloy
16854b77ee
S1 - Path Traversal Prevention: - Add _validate_assembly_path() helper in server.py - Validates: non-empty path, file exists, is regular file, .dll/.exe extension - Resolves to absolute path to prevent path traversal attacks - Applied to all 12 tools that accept assembly_path S2 - Temp Directory Race Condition Fix: - Replace tempfile.mkdtemp() with TemporaryDirectory context manager - Guarantees cleanup even on exceptions - Refactor decompile() to use _decompile_to_dir() helper S3 - Subprocess Output Size Limits: - Add MAX_OUTPUT_BYTES constant (50MB) - Truncate stdout/stderr if exceeded to prevent memory exhaustion - Add truncation warning to output when limit is hit S4 - Assembly File Size Limits: - Add MAX_ASSEMBLY_SIZE_MB constant (500MB) in metadata_reader.py - Check file size before loading with dnfile - Add AssemblySizeError exception for clear error messages Tests: - Add tests/test_security.py with 18 unit tests covering all validations - All 53 tests pass (security tests + existing tests)
12 lines
512 B
JSON
12 lines
512 B
JSON
{
|
|
"project": "mcilspy-code-review-fixes",
|
|
"created": "2025-02-08T00:00:00Z",
|
|
"domains": {
|
|
"security": { "status": "ready", "branch": "fix/security", "priority": 1 },
|
|
"architecture": { "status": "pending", "branch": "fix/architecture", "priority": 2 },
|
|
"performance": { "status": "pending", "branch": "fix/performance", "priority": 3 },
|
|
"testing": { "status": "pending", "branch": "fix/testing", "priority": 4 }
|
|
},
|
|
"merge_order": ["security", "architecture", "performance", "testing"]
|
|
}
|