mirror of
https://github.com/ruvnet/ruflo.git
synced 2026-09-14 14:01:28 +08:00
Dragan Spiridonov
e50df67226
* fix: critical security & performance fixes across 6 packages Addresses 11 vulnerabilities from security audit + 5 additional issues found during devil's advocate review, plus test suite fixes across memory, security, and swarm packages. ## Security Fixes (Critical) - CRIT-01: SQL injection in embeddings search — replaced string interpolation with parameterized queries (db.prepare/bind) - CRIT-02: Command injection in 4 files — replaced execSync template literals with execFileSync + input validation regex: - ruvector/import.ts (docker container name) - init.ts (embedding model name, 2 locations) - agent-browser-adapter.ts (CLI args) - CRIT-03: Browser eval hardening — 12 dangerous patterns blocked, configurable 20KB length limit via CLAUDE_FLOW_MAX_EVAL_SCRIPT_LENGTH ## Security Fixes (High) - HIGH-01: ESLint rules restricting child_process imports (both import and require) with overrides for safe-executor/daemon/mcp-server - HIGH-02: Hive-mind truthiness fix (=== true vs !== false) - HIGH-03: Prototype pollution prevention — safeJsonParse with JSON reviver stripping __proto__/constructor/prototype in 3 memory backends - HIGH-04: Plugin sandbox warning on unsandboxed plugin load - HIGH-05: HNSW hash collision fix — dual-hash (djb2+sdbm) producing 53-bit values with bidirectional map and linear probing ## Security Fixes (DA Review) - DA-CRIT-1: Local json-security.ts to avoid cross-package imports - DA-CRIT-2: PostgreSQL schema name validation (validateSchemaName) added to all 6 ruvector commands via pg-utils.ts - DA-CRIT-3: PID injection prevention in mcp-server — /proc read + execFileSync replacing execSync with PID interpolation - DA-HIGH-3: Timestamp validation (validateTimestamp) in ruvector import - DA-HIGH-4: 4 additional browser eval bypass patterns (globalThis, .constructor, Reflect, eval()) - DA-HIGH-5: ESLint no-restricted-modules for require() coverage ## Performance Fixes - PERF-01: BoundedSet<T> for gossip seenMessages — Map-based LRU eviction capped at 100K entries, prevents unbounded memory growth - PERF-02: Bulk operations use Promise.allSettled with batch size 50, logging partial failures instead of aborting - PERF-03: CLI lazy loading — reduced sync imports from 37 to 10 core commands, async getCommandsByCategory() for help display ## Test Suite Fixes - Fixed 11 broken import paths in security tests (../../security/ → ../src/ and ../../helpers/ → ../helpers/) - Added vitest.config.ts for security package (was inheriting root config with missing setup.ts reference) - Added allowedDirectories to SecurityConfig test fixture - Fixed sanitizePath test expectation (leading slash removal) - Fixed hardcoded /workspaces/claude-flow path in memory tests - Fixed semanticRouter controller test (auto-enables with agentdb) - Fixed database-provider count test (namespace-scoped assertion) - Fixed swarm latency tests (toBeGreaterThanOrEqual for sub-ms mocks) - Added TypeScript as dev dependency for build verification ## Verification - 22 automated security verification tests in security-verification.test.ts covering all 10 user-facing scenarios - All 5 packages type-check clean (0 errors) - memory: 9/9 suites, 353/353 tests pass - swarm: 4/4 suites, 172/172 tests pass - security: 13/13 suites, 444/444 tests pass - CLI help displays all 35 commands correctly with lazy loading ## New Files - v3/@claude-flow/cli/src/commands/ruvector/pg-utils.ts - v3/@claude-flow/cli/.eslintrc.json - v3/@claude-flow/cli/__tests__/security-verification.test.ts - v3/@claude-flow/memory/src/json-security.ts - v3/@claude-flow/security/vitest.config.ts Co-Authored-By: claude-flow <ruv@ruv.net> * fix: address Sherlock review findings for PR #1558 Finding 2 (MUST FIX): Add formatEmbedding array-element validation - Validate each embedding value is typeof number && Number.isFinite() - Prevents SQL injection via crafted JSON arrays with string payloads - Throws descriptive error with index for debugging Finding 1: Reclassify CRIT-03 eval blocklist as defense-in-depth - Add comment clarifying pattern blocklist is best-effort, not a sandbox - Primary defense is the browser sandbox itself - Update test description to reflect defense-in-depth classification Finding 3: Add behavioral tests alongside source-guards - Add formatEmbedding behavioral test with hostile inputs (NaN, Infinity, strings) - Add CRIT-02 behavioral test verifying execFileSync array argument pattern - Categorize existing tests as source-guard vs behavioral in comments Finding 4: Flag HIGH-02 as behavior change - Add comment explaining === true vs !== false semantic difference - Documents that undefined/null no longer treated as "skip permissions" Finding 6: Export BoundedSet, fix test semantics - Export BoundedSet from gossip.ts for reuse - Fix test to use FIFO semantics matching production (not LRU) - Add FIFO-specific test: re-adding doesn't refresh position Finding 7: Fix BoundedSet comment math - Remove speculative throughput time estimate - Use factual memory calculation: 100K × ~40B IDs ≈ 4MB Finding 5: No change (false positive — Math.abs in manhattanDistance is correct) Co-Authored-By: claude-flow <ruv@ruv.net> --------- Co-authored-by: claude-flow <ruv@ruv.net>
21 lines
400 B
TypeScript
21 lines
400 B
TypeScript
import { defineConfig } from 'vitest/config';
|
|
|
|
export default defineConfig({
|
|
test: {
|
|
globals: true,
|
|
environment: 'node',
|
|
coverage: {
|
|
provider: 'v8',
|
|
reporter: ['text', 'json', 'html'],
|
|
exclude: [
|
|
'node_modules/**',
|
|
'__tests__/**',
|
|
'**/*.test.ts',
|
|
'**/*.spec.ts',
|
|
],
|
|
},
|
|
testTimeout: 10000,
|
|
hookTimeout: 10000,
|
|
},
|
|
});
|