 Alexandre Teixeira
|
de8f151632
|
fix(security): harden trace teardown and gallery error responses
- CodeQL #1202 (tests/e2e/teardown.js): replace execSync shell execution with
execFileSync, passing python executable and sanitizer arguments separately with
shell: false. Preserve ODYSSEUS_TEST_PYTHON support, timeout handling, and
fail-closed deletion.
- CodeQL #1203 (routes/gallery/gallery_routes.py): prevent exception information
exposure in /api/image/edit-progress by returning a generic rejection response
without leaking internal hostnames, IPs, resolver errors, or credentials.
- Add regression tests covering paths with spaces, metacharacters, synthetic command
substitutions, process failure modes, fail-closed artifact purge, and SSRF
rejection confidentiality.
|
2026-10-28 21:10:12 +00:00 |
|