feat(security): harden query, serve, and validate read surfaces#180
Merged
Conversation
Close the formatted-query query_only gap, require --token on non-loopback serve binds, and reject validate paths that escape the project root or symlink outside it.
Add changeset and serve-bind-policy with runHttpServer enforcement; align validate/serve consumer surfaces (CLI help, MCP, glossary, README, agent-content); extend symlink containment tests.
Add realpath-safe validate reads, broken-symlink rejection, 127.0.0.0/8 loopback token policy, expanded DML/format tests, and consumer-surface parity.
🦋 Changeset detectedLatest commit: 2e4cdfc The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
Warning Review limit reached
More reviews will be available in 13 minutes and 30 seconds. Learn how PR review limits work. Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (16)
📝 WalkthroughWalkthroughThis PR hardens codemap's read-surface by enforcing read-only guards on formatted queries, requiring authentication tokens for non-loopback HTTP binds, and rejecting unsafe file paths that traverse symlinks or escape the project root. ChangesRead-surface security hardening
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/application/serve-bind-policy.ts`:
- Around line 13-16: isLoopbackHost currently treats the bracketed IPv6 literal
"[::1]" as valid loopback, but server.listen expects unbracketed "::1"; update
isLoopbackHost (or the caller that passes opts.host to server.listen) to
normalize bracketed IPv6 by converting "[::1]" to "::1" before returning/using
it, or remove "[::1]" from the accepted values so callers must normalize.
Specifically, modify isLoopbackHost (and/or the code that forwards opts.host to
server.listen) to strip surrounding brackets from IPv6 literals (e.g., transform
"[::1]" -> "::1") so server.listen receives a non-bracketed IPv6 address.
In `@src/cli/cmd-query-formatted.test.ts`:
- Around line 1-4: Update the top-of-file header comment in
src/cli/cmd-query-formatted.test.ts to accurately describe the test scope:
replace the phrase "on the sarif path" with wording that indicates multiple
formatted-output paths are covered (e.g., "on the formatted output paths
(`sarif`, `badge`, `mermaid`, `annotations`, `codeclimate`)") so the comment for
the test file accurately reflects that DML/blocking via queryRows and PRAGMA
query_only is asserted across all those formats.
In `@src/cli/cmd-validate.test.ts`:
- Around line 201-214: Replace the fixed temp directory creation in the "rejects
absolute paths outside the project root" test with a unique tmp dir created via
mkdtempSync (use os.tmpdir()/mkdtempSync) and ensure cleanup happens in a
finally block; update the test to write the outsideFile inside that mkdtempSync
directory, call computeValidateRows(db, tmpRoot, [outsideFile]) as before, and
rmSync the mkdtemp-created directory in the finally to avoid cross-run
collisions and flaky cleanup.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 027384fd-df05-4b01-b7a6-ec40b41530b2
📒 Files selected for processing (26)
.changeset/read-surface-hardening.mdREADME.mddocs/architecture.mddocs/glossary.mddocs/plans/impact-inpath-homonyms.mddocs/plans/runtime-test-isolation.mddocs/plans/security-hardening-orchestrator.mddocs/plans/security-hardening-wave1.mddocs/roadmap.mdsrc/application/http-server.tssrc/application/mcp-server.tssrc/application/path-containment.test.tssrc/application/path-containment.tssrc/application/serve-bind-policy.test.tssrc/application/serve-bind-policy.tssrc/application/validate-engine.tssrc/cli/bootstrap.tssrc/cli/cmd-query-formatted.test.tssrc/cli/cmd-query.tssrc/cli/cmd-serve.test.tssrc/cli/cmd-serve.tssrc/cli/cmd-validate.test.tssrc/cli/cmd-validate.tssrc/test/symlink-capable.tstemplates/agent-content/skill/10-recipes-context.mdtemplates/agent-content/skill/50-maintenance.md
Adds missing-test eval fixture, LEDGER.md, vet/reconcile/quick modes, score-probe recall scorer, and test:harden-probes smoke. Live probe run: recall 1.0 on golden finding.
Keep harden-pr skill, LEDGER.md, and tracer-bullets wiring; remove fixtures/harden-probes, score-probe harness, and related docs.
Strip [::1] to ::1 in parseServeRest and runHttpServer; tighten test hygiene and formatted-query test header per review.
Align validate reason docs across consumer surfaces, extend formatted-query DML coverage to diff formats, retire security-hardening-wave1 plan with orchestrator/roadmap updates.
Merged
5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
query_onlygap:printFormattedQueryroutes throughqueryRows, with E2E DML guards across sarif/badge/mermaid/annotations/codeclimate.--tokenon non-loopbackcodemap servebinds (enforced in CLI +runHttpServer); treat full127.0.0.0/8as loopback for token policy.codemap validatewith per-rowrejectedstatus +reasonfor paths that escape the project root, resolve outside via symlink, or are broken symlinks — reads go throughreadUtf8WithinProjectRoot(realpath re-check before read).Test plan
bun test src/cli/cmd-query-formatted.test.ts src/cli/cmd-serve.test.ts src/cli/cmd-validate.test.ts src/application/path-containment.test.ts src/application/serve-bind-policy.test.tsSummary by CodeRabbit
Release Notes
New Features
codemap validatenow reportsrejectedstatus with detailed reasons for unsafe paths (escaping project root, symlink traversals, broken symlinks).Bug Fixes
codemap query --formatnow enforces the same read-only protection as--json, blocking mutations.codemap serverequires--tokenfor non-loopback hosts; loopback addresses (127.0.0.0/8) remain optional.Documentation