mirror of
https://github.com/ruvnet/RuView.git
synced 2026-07-10 01:30:01 +00:00
72bbd256e7
Some checks failed
Continuous Deployment / Deploy to Staging (push) Blocked by required conditions
Continuous Deployment / Pre-deployment Checks (push) Waiting to run
Continuous Deployment / Deploy to Production (push) Blocked by required conditions
Continuous Deployment / Rollback Deployment (push) Blocked by required conditions
Continuous Deployment / Post-deployment Monitoring (push) Blocked by required conditions
Continuous Deployment / Notify Deployment Status (push) Blocked by required conditions
Continuous Integration / Code Quality & Security (push) Waiting to run
Continuous Integration / Docker Build & Test (push) Blocked by required conditions
Continuous Integration / API Documentation (push) Blocked by required conditions
Continuous Integration / Notify (push) Blocked by required conditions
Continuous Integration / Rust Workspace Tests (push) Waiting to run
Continuous Integration / Tests (push) Waiting to run
Continuous Integration / Tests-1 (push) Waiting to run
Continuous Integration / Tests-2 (push) Waiting to run
Continuous Integration / Performance Tests (push) Blocked by required conditions
Firmware CI / Verify version.txt matches release tag (push) Waiting to run
Firmware CI / Build ESP32-S3 Firmware (4mb) (push) Waiting to run
Firmware CI / Build ESP32-S3 Firmware (8mb) (push) Waiting to run
Firmware QEMU Tests (ADR-061) / Build Espressif QEMU (push) Waiting to run
Firmware QEMU Tests (ADR-061) / QEMU Test (boundary-max) (push) Blocked by required conditions
Firmware QEMU Tests (ADR-061) / QEMU Test (boundary-min) (push) Blocked by required conditions
Firmware QEMU Tests (ADR-061) / QEMU Test (default) (push) Blocked by required conditions
Firmware QEMU Tests (ADR-061) / QEMU Test (edge-tier0) (push) Blocked by required conditions
Firmware QEMU Tests (ADR-061) / QEMU Test (edge-tier1) (push) Blocked by required conditions
Firmware QEMU Tests (ADR-061) / QEMU Test (full-adr060) (push) Blocked by required conditions
Firmware QEMU Tests (ADR-061) / QEMU Test (tdm-3node) (push) Blocked by required conditions
Firmware QEMU Tests (ADR-061) / Fuzz Testing (ADR-061 Layer 6) (push) Waiting to run
Firmware QEMU Tests (ADR-061) / NVS Matrix Generation (push) Waiting to run
Firmware QEMU Tests (ADR-061) / Swarm Test (ADR-062) (push) Blocked by required conditions
Fix-Marker Regression Guard / Verify fix markers (push) Waiting to run
Security Scanning / Static Application Security Testing (push) Waiting to run
Security Scanning / Dependency Vulnerability Scan (push) Waiting to run
Security Scanning / Container Security Scan (push) Waiting to run
Security Scanning / Infrastructure Security Scan (push) Waiting to run
Security Scanning / Secret Scanning (push) Waiting to run
Security Scanning / License Compliance Scan (push) Waiting to run
Security Scanning / Security Policy Compliance (push) Waiting to run
Security Scanning / Security Report (push) Blocked by required conditions
wifi-densepose sensing-server → Docker Hub + ghcr.io / build · push · smoke-test (push) Waiting to run
nvsim Dashboard → GitHub Pages / build-and-deploy (push) Has been cancelled
nvsim-server → ghcr.io / build-and-publish (push) Has been cancelled
Verify Pipeline Determinism / Verify Pipeline Determinism (push) Has been cancelled
Reported by @bannned-bit. Five endpoints in
v2/crates/wifi-densepose-sensing-server embedded user-controlled
identifiers in format!() paths with no sanitization:
recording.rs POST /api/v1/recording/start (session_name)
recording.rs GET /api/v1/recording/download/:id (id)
recording.rs DELETE /api/v1/recording/delete/:id (id)
model_manager.rs POST /api/v1/models/load (model_id)
training_api.rs load_recording_frames (dataset_ids[])
Each unauthenticated caller could:
- READ arbitrary files via ../../etc/passwd, ../../.env, etc.
- WRITE attacker-controlled JSONL via recording/start
- LOAD attacker-controlled .rvf model files
- DELETE arbitrary files the server process can touch
New `path_safety` module exports `safe_id(&str) -> Result<&str, PathSafetyError>`
that enforces the rejection envelope BEFORE any user input reaches a
format!() that builds a path:
- Allowed character set: [A-Za-z0-9._-]
- Reject leading '.' (rules out '.', '..', '.env', hidden files)
- Reject empty strings
- Reject anything > 64 bytes
- Reject all whitespace, path separators, null bytes, non-ASCII
Applied at all 5 sites. Errors return 400 Bad Request (download) /
status:"error" JSON (others) — not panics.
9 unit tests in path_safety::tests cover:
- accepts simple alphanumeric / hyphen / underscore / dot
- rejects empty, leading dot, path separators ('/', '\'),
null byte, whitespace, shell specials, non-ASCII (including
fullwidth slash U+FF0F), too-long, boundary at MAX_ID_LEN
test result: ok. 9 passed; 0 failed
cargo build -p wifi-densepose-sensing-server --no-default-features: 33s
Fix-marker RuView#615 in scripts/fix-markers.json prevents removing the
guard at any of the 5 call sites. CHANGELOG entry under [Unreleased] /
Security documents the patched endpoints and the rejection envelope.
Severity: critical per reporter — five remotely-reachable paths to read,
write, or delete arbitrary files. Hot per-request paths, not edge cases.
|
||
|---|---|---|
| .. | ||
| swarm_presets | ||
| align-ground-truth.js | ||
| apnea-detector.js | ||
| benchmark-model.py | ||
| benchmark-rf-scan.js | ||
| benchmark-ruvllm.js | ||
| benchmark-wiflow.js | ||
| check_fix_markers.py | ||
| check_health.py | ||
| collect-ground-truth.py | ||
| collect-training-data.py | ||
| csi-graph-visualizer.js | ||
| csi-spectrogram.js | ||
| deep-scan.js | ||
| device-fingerprint.js | ||
| esp32_jsonl_to_rvcsi.py | ||
| esp32_wasm_test.py | ||
| eval-wiflow.js | ||
| fix-markers.json | ||
| gait-analyzer.js | ||
| gcloud-train.sh | ||
| generate-witness-bundle.sh | ||
| generate_nvs_matrix.py | ||
| inject_fault.py | ||
| install-qemu.sh | ||
| mac-mini-train.sh | ||
| material-classifier.js | ||
| material-detector.js | ||
| mesh-graph-transformer.js | ||
| mincut-person-counter.js | ||
| mmwave_fusion_bridge.py | ||
| passive-radar.js | ||
| probe-fft-platform.py | ||
| provision.py | ||
| publish-huggingface.py | ||
| publish-huggingface.sh | ||
| qemu-chaos-test.sh | ||
| qemu-cli.sh | ||
| qemu-esp32s3-test.sh | ||
| qemu-mesh-test.sh | ||
| qemu-snapshot-test.sh | ||
| qemu_swarm.py | ||
| record-csi-udp.py | ||
| release-v0.5.4.sh | ||
| rf-scan-multifreq.js | ||
| rf-scan.js | ||
| rf-tomography.js | ||
| room-fingerprint.js | ||
| seed_csi_bridge.py | ||
| sleep-monitor.js | ||
| snn-csi-processor.js | ||
| stress-monitor.js | ||
| swarm_health.py | ||
| through-wall-detector.js | ||
| train-camera-free.js | ||
| train-ruvllm.js | ||
| train-wiflow-supervised.js | ||
| train-wiflow.js | ||
| training-config-sweep.json | ||
| udp-relay.py | ||
| validate_mesh_test.py | ||
| validate_qemu_output.py | ||
| wiflow-model.js | ||