feat(audit): complete Paket H hardening pass - #17
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c4fc62e31e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| except OSError: | ||
| logger.warning("Config file could not be read, using defaults", exc_info=True) | ||
| return _deep_merge(DEFAULTS, {}) |
There was a problem hiding this comment.
If config.json exists but contains invalid UTF-8 bytes, Path.read_text(encoding="utf-8") raises UnicodeDecodeError, which is not a json.JSONDecodeError or OSError. Before this change the broad handler fell back to defaults, but now app startup via BlitztextConfig(...) crashes instead of recovering from a corrupt hand-edited config file.
Useful? React with 👍 / 👎.
| if [[ -n "${SECRETS_PERMS}" ]] && (( 10#${SECRETS_PERMS} > 600 )); then | ||
| echo "WARNUNG: ${SECRETS_FILE} hat zu offene Rechte (${SECRETS_PERMS}); erwartet 600 oder restriktiver." >&2 |
There was a problem hiding this comment.
For permission modes like 0440 or 0040, the secrets file is group-readable but 10#${SECRETS_PERMS} > 600 is false, so run.sh sources it without the intended warning. Since the hardening is meant to warn for anything looser than owner-only access, this needs to test group/other permission bits rather than compare the octal string as a decimal number.
Useful? React with 👍 / 👎.
1 participant
Summary
Implements Paket H audit hardening with verified low-risk fixes and one intentional defer.
Included
run.shsecrets sourcing with ownership/permission checks while keeping safesourcebehaviorPath(...).resolve()defense-in-depth in transcription path handlingMagicMockfallback with a small null client stubPasteServicekey delay configurable and wire it through app init/runtime updatesCUDA_VISIBLE_DEVICESoverride to the OpenAI Whisper call and restore it afterwardsmarinandcedarbecause they are valid in the installed clientDeferred intentionally
select(..., 1.0)and fd cleanup behaviorVerification
./.venv/bin/python -m pytest -q252 passed, 18 skippedNotes
grep | xargs, because that would break values with spaces or special characters.