mirror of
https://github.com/DeusData/codebase-memory-mcp.git
synced 2026-11-10 09:13:53 +08:00
Martin Vogel
cd1417427c
Code-level defenses: - cbm_validate_shell_arg(): reject shell metacharacters before popen/system - SQLite authorizer: block ATTACH/DETACH at engine level - CORS localhost-only origin reflection (replaces wildcard *) - Path containment: realpath() check in get_code_snippet - process-kill restricted to server-spawned PIDs - SHA256 checksum verification in update command Security audit scripts (8 layers): - L1: Static allow-list for dangerous calls + URLs - L2: Binary string audit (URLs, payloads, credentials) - L3: Network egress monitoring via strace (Linux) - L4: Install output path + content validation - L5: Smoke test hardening (clean shutdown, residual procs) - L6: Graph UI audit (external domains, CORS, binding) - L7: MCP robustness (23 adversarial JSON-RPC payloads) - L8: Vendored integrity (checksums + dangerous call scan) CI: parallel security-static job (no build needed), binary layers in smoke jobs per-platform. Cleanup of test fixture dirs in clean.sh + .gitignore.
46 lines
2.9 KiB
Plaintext
46 lines
2.9 KiB
Plaintext
# Security allow-list for dangerous function calls.
|
|
# Format: file:function:justification
|
|
# Lines starting with # are comments. Empty lines are ignored.
|
|
# Any call to a listed function in a .c file under src/ that is NOT on this
|
|
# list causes the security audit (scripts/security-audit.sh) to fail.
|
|
|
|
# ── Foundation: platform abstraction (defines cbm_popen wrapper) ───────────
|
|
src/foundation/compat_fs.c:popen:cbm_popen wrapper definition (POSIX)
|
|
src/foundation/compat_fs.c:cbm_popen:cbm_popen function definition
|
|
|
|
# ── CLI: update command (user-initiated, interactive) ──────────────────────
|
|
src/cli/cli.c:system:curl download of release binary (update cmd)
|
|
src/cli/cli.c:system:unzip extraction on Windows (update cmd)
|
|
src/cli/cli.c:system:version verification after update (update cmd)
|
|
src/cli/cli.c:cbm_popen:sha256 checksum verification (update cmd)
|
|
src/cli/cli.c:popen:sha256 checksum computation via shasum
|
|
|
|
# ── Watcher: git status polling (repo paths validated via cbm_validate_shell_arg) ──
|
|
src/watcher/watcher.c:system:git repo detection (is_git_repo)
|
|
src/watcher/watcher.c:cbm_popen:git HEAD hash (git_head)
|
|
src/watcher/watcher.c:cbm_popen:git working tree status (git_is_dirty)
|
|
src/watcher/watcher.c:cbm_popen:git file count (git_file_count)
|
|
src/watcher/watcher.c:popen:via cbm_popen wrapper calls
|
|
|
|
# ── MCP server: search and change detection ────────────────────────────────
|
|
src/mcp/mcp.c:cbm_popen:search_code via grep (pattern in temp file, path validated)
|
|
src/mcp/mcp.c:cbm_popen:detect_changes via git diff (args validated)
|
|
src/mcp/mcp.c:cbm_popen:git ls-files count for auto-index (session_root validated)
|
|
src/mcp/mcp.c:cbm_popen:update check to api.github.com (hardcoded URL)
|
|
src/mcp/mcp.c:popen:via cbm_popen wrapper calls
|
|
|
|
# ── Pipeline: git history parsing (fallback when libgit2 not available) ────
|
|
src/pipeline/pass_githistory.c:cbm_popen:git log for file history (path validated)
|
|
src/pipeline/pass_githistory.c:popen:via cbm_popen wrapper call
|
|
|
|
# ── UI: HTTP server process management ─────────────────────────────────────
|
|
src/ui/http_server.c:popen:ps process listing for metrics endpoint
|
|
src/ui/http_server.c:fork:spawn indexing subprocess
|
|
src/ui/http_server.c:execl:exec indexing binary in child process
|
|
|
|
# ── Allowed URLs ───────────────────────────────────────────────────────────
|
|
# Format: URL:justification
|
|
URL:https://api.github.com/repos/DeusData/codebase-memory-mcp/releases/latest:update check
|
|
URL:https://github.com/DeusData/codebase-memory-mcp/releases/latest/download/:binary download + checksums
|
|
URL:http://127.0.0.1:UI server binding (localhost only)
|