mirror of
https://github.com/allaunthefox/Research-Stack.git
synced 2026-07-31 03:05:21 +00:00
85506530f2
* fix(security): remove hardcoded secrets, patch command injection, tighten CORS and Cypher guard
- run_import_workflow.py, run_multi_import.py: replace hardcoded budget
password with BUDGET_PASSWORD env-var (fail-fast if unset)
- server.js /ingest: replace shell-interpolated exec() with execFile()
so user-controlled title/body cannot inject shell commands
- authentik-values.yaml: blank out bootstrap_password and bootstrap_token
so they must be supplied at deploy time via --set or sealed-secret
- cluster-dashboard main.py: restrict CORS from allow_origins=["*"] to
env-configurable whitelist (default: dashboard.researchstack.info),
methods to GET, headers to Authorization+Content-Type
- neo4j_obsidian_connector_router.js (both copies): replace permissive
prefix-only readOnly regex with a deny-list that blocks
CREATE/MERGE/DELETE/DETACH/SET/REMOVE/DROP anywhere in the query, and
route readOnly queries through session.readTransaction()
Co-Authored-By: Allaun Silverfox <bigdataiscoming+9i37y6j2@protonmail.com>
* fix(security): add CALL procedure allowlist for Cypher readOnly, add OPTIONS to CORS
- Cypher guard: restore positive allowlist for CALL targets (only db.* and
apoc.meta.* allowed in readOnly mode). Extract cypherReadOnlyViolation()
helper for clarity. Both copies updated.
- CORS: add OPTIONS to allow_methods so preflight requests succeed.
Co-Authored-By: Allaun Silverfox <bigdataiscoming+9i37y6j2@protonmail.com>
* fix(security): use negative lookahead for CALL allowlist, remove dead CALL\s*\{ branch
- Replace two-regex CALL check with single negative-lookahead
CYPHER_CALL_DISALLOWED_RE = /\bCALL\s+(?!db\.|apoc\.meta\.)/i
This correctly blocks queries containing ANY disallowed CALL target,
even when bundled alongside an allowed CALL db.* or CALL apoc.meta.*.
- Remove dead CALL\s*\{ alternative from CYPHER_WRITE_RE — the trailing
\b never matched because { is a non-word character.
- Both copies updated identically.
Co-Authored-By: Allaun Silverfox <bigdataiscoming+9i37y6j2@protonmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Allaun Silverfox <bigdataiscoming+9i37y6j2@protonmail.com>
|
||
|---|---|---|
| .. | ||
| AppFlowy-Cloud | ||
| audio-dsp | ||
| audit | ||
| caddy-edge | ||
| cff | ||
| cluster-dashboard | ||
| compression-core | ||
| dashboard | ||
| hutter_prize | ||
| linear-native-tauri | ||
| nodupe | ||
| notion-native-tauri | ||
| out/verilog | ||
| parquet_compressor | ||
| pist-scripts | ||
| plugins/substack-connector | ||
| scripts | ||
| teleport-kanban | ||
| tests | ||
| text-to-cad | ||
| tools-scripts | ||
| webrtc-bridge | ||
| finance_manager.py | ||
| README.md | ||
| requirements_swarm_api.txt | ||
| visualizer_service.py | ||
5-Applications
Purpose: End-to-end pipelines, integration tests, automation scripts, benchmarks, audit.
Depends on: 0 through 4
Contents (Target)
| Source | Destination |
|---|---|
5-Applications/scripts/ |
5-Applications/scripts/ |
5-Applications/tests/ |
5-Applications/tests/ |
5-Applications/out/ |
5-Applications/out/ |
5-Applications/audit/ |
5-Applications/audit/ |
Scripts
build_manifold_graphml.pyexport_manifold_to_obsidian.pyhot_swap_daemon.pyhot_swap_manager.py
Pipeline
- Generate provably hard question (Builder: ADD clock)
- Route via OmnidirectionalInterface (Lean)
- Execute via DomainModelIntegration (Lean → Python shim)
- Store in Google Drive topological storage (Warden: SUBTRACT clock)
- Hardware triumvirate integration (Judge: PAUSE clock)