fix(security): triage mokosh-apps audit roll-up findings (MAPPS-308) #374
Loading…
Reference in a new issue
No description provided.
Delete branch "security/MAPPS-308-audit-rollup-triage"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Triage all 14 medium/low/info findings from the 2026-06-25 mokosh-apps security audit. Disposition recorded per finding in dev-docs/audits/security-2026-06-25/triage.md: fixed, already mitigated by prior work, or risk-accepted with rationale.
Applied two safe, self-contained fixes:
M2 (nu injection via branch name): create-release.yml interpolated the contributor-named PR head ref into a nu string literal at the YAML-templating layer, so a branch like
release/v1");^evil;("could break out and run as nu code with the release job's contents:write PAT. Route the ref through step env: as PR_HEAD_REF and read it as data via $env.PR_HEAD_REF, matching the env-routing pattern from MAPPS-306 / MAPPS-307.L2 (missing security headers): add X-Frame-Options DENY + CSP frame-ancestors 'none' (clickjacking), X-Content-Type-Options nosniff, Referrer-Policy strict-origin-when-cross-origin, and -Server to the Caddyfile. A full content CSP is intentionally deferred: connect-src depends on the runtime-injected OIDC/API origins and would break sign-in if hardcoded; residual risk noted in the triage doc.
Remaining findings are already mitigated (M4, L3, I2 via classify_return_to and the merge+release/v gate) or risk-accepted with documented rationale and exit paths (M1, M3, M5, L1, L4, L5, L6, I1, I3).
#MAPPS-308
Triage all 14 medium/low/info findings from the 2026-06-25 mokosh-apps security audit. Disposition recorded per finding in dev-docs/audits/security-2026-06-25/triage.md: fixed, already mitigated by prior work, or risk-accepted with rationale. Applied two safe, self-contained fixes: M2 (nu injection via branch name): create-release.yml interpolated the contributor-named PR head ref into a nu string literal at the YAML-templating layer, so a branch like `release/v1");^evil;("` could break out and run as nu code with the release job's contents:write PAT. Route the ref through step env: as PR_HEAD_REF and read it as data via $env.PR_HEAD_REF, matching the env-routing pattern from MAPPS-306 / MAPPS-307. L2 (missing security headers): add X-Frame-Options DENY + CSP frame-ancestors 'none' (clickjacking), X-Content-Type-Options nosniff, Referrer-Policy strict-origin-when-cross-origin, and -Server to the Caddyfile. A full content CSP is intentionally deferred: connect-src depends on the runtime-injected OIDC/API origins and would break sign-in if hardcoded; residual risk noted in the triage doc. Remaining findings are already mitigated (M4, L3, I2 via classify_return_to and the merge+release/v gate) or risk-accepted with documented rationale and exit paths (M1, M3, M5, L1, L4, L5, L6, I1, I3). #MAPPS-308