Harden dashboard server and CI pipeline#3
Merged
Conversation
- dashboard.ts: add Content-Security-Policy, X-Content-Type-Options, X-Frame-Options headers to every response - dashboard.ts: fix DNS-rebinding guard to fail-closed (empty/absent Host header was previously allowed through) - dashboard.ts: cap concurrent SSE /clock connections at 8 to prevent unbounded timer accumulation - dashboard.ts: enforce application/json Content-Type on /cmd POST - dashboard.ts: log server errors to stderr instead of silently dropping - track.ts: escape param string before constructing RegExp in applyParam to prevent regex injection / ReDoS from untrusted POST bodies - ci.yml: pin actions/checkout and actions/setup-node to full commit SHAs to protect against mutable tag supply-chain attacks https://claude.ai/code/session_011GALMvXr1b8uKfPy17fxxK
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Defense-in-depth hardening for the localhost dashboard server (which can run arbitrary Tidal/SC code via
/cmd) plus a CI supply-chain pin. One commit, +37 / −7 across 3 files.mcp/src/dashboard.tsX-Content-Type-Options: nosniff,X-Frame-Options: DENY, and a CSP (default-src 'self',style-src 'self' 'unsafe-inline',connect-src 'self',object-src 'none',frame-ancestors 'none').Hostheader is now rejected (was previously allowed through)./clockSSE connections at 8 (429beyond that) to prevent unboundedsetIntervalaccumulation; counter decremented on connection close.application/jsonbodies on/cmdwith415(empty content-type still allowed).mcp/src/track.tsparamname insideapplyParambefore building theRegExp, preventing regex-injection / malformed matches..github/workflows/ci.ymlactions/checkout(v4.2.2) andactions/setup-node(v4.4.0) to commit SHAs.Test plan
npm cicleannpm run buildclean (tsc)npm test— all 31 tests passdashboard.htmlloads all scripts via<script src>, has no inline event handlers, no external resources;EventSource/fetchare same-origindashboard.jsalready sendsapplication/json)https://claude.ai/code/session_01G8QLPJGNExEePDLtCsukBJ
Generated by Claude Code