Close security audit low findings and migrate container builds to justfile #53
Loading…
Reference in a new issue
No description provided.
Delete branch "refs/pull/53/head"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Closes #52
Summary
os.umask(0o027)added toentrypoint.shbefore exec, so log files are created as0o640rather than world-readable. One test added.logger.infoadded at six API mutation points (key generate/revoke, blocked user/hashtag add/delete), each including client IP. Six tests added.fenliu-docker-publish.ymlandzhongli-container.ymldeleted from Woodpecker;publish-containerrecipe added to each justfile usingpodman(amd64, Codeberg only).Test plan
uv run --directory packages/fenliu tryke testpasses with zero failuresuv run --directory packages/fenliu ruff check .cleanuv run --directory packages/fenliu ty check .cleanSecurity-Audit.mdpackages/fenliu/tests/test_l2_audit_logging.pyline 63✅ Valid observation. The original tests verified the format-string keyword but not the value of the client IP argument. Fixed in commit
ef69f49— each of the six test functions now additionally assertsmock_logger.info.call_args[0][-1] == "10.0.0.1"(the last positional arg is alwaysclient_ipfor every log call in the implementation).packages/fenliu/tests/test_l2_audit_logging.pyline 79✅ Valid observation. The original tests verified the format-string keyword but not the value of the client IP argument. Fixed in commit
ef69f49— each of the six test functions now additionally assertsmock_logger.info.call_args[0][-1] == "10.0.0.1"(the last positional arg is alwaysclient_ipfor every log call in the implementation).packages/fenliu/tests/test_l2_audit_logging.pyline 106✅ Valid observation. The original tests verified the format-string keyword but not the value of the client IP argument. Fixed in commit
ef69f49— each of the six test functions now additionally assertsmock_logger.info.call_args[0][-1] == "10.0.0.1"(the last positional arg is alwaysclient_ipfor every log call in the implementation).packages/fenliu/tests/test_l2_audit_logging.pyline 127✅ Valid observation. The original tests verified the format-string keyword but not the value of the client IP argument. Fixed in commit
ef69f49— each of the six test functions now additionally assertsmock_logger.info.call_args[0][-1] == "10.0.0.1"(the last positional arg is alwaysclient_ipfor every log call in the implementation).packages/fenliu/tests/test_l2_audit_logging.pyline 154✅ Valid observation. The original tests verified the format-string keyword but not the value of the client IP argument. Fixed in commit
ef69f49— each of the six test functions now additionally assertsmock_logger.info.call_args[0][-1] == "10.0.0.1"(the last positional arg is alwaysclient_ipfor every log call in the implementation).packages/fenliu/tests/test_l2_audit_logging.pyline 175✅ Valid observation. The original tests verified the format-string keyword but not the value of the client IP argument. Fixed in commit
ef69f49— each of the six test functions now additionally assertsmock_logger.info.call_args[0][-1] == "10.0.0.1"(the last positional arg is alwaysclient_ipfor every log call in the implementation).packages/fenliu/tests/test_l2_audit_logging.pyline 61✅ Fixed in commit
ef69f49— all six test functions now assertmock_logger.info.call_args[0][-1] == "10.0.0.1". The last positional arg isclient_ipfor every log call, so this one pattern covers all six handlers.packages/fenliu/Security-Audit-detail.mdline 481✅ Fixed in commit
ef69f49— the redundant**Status:** ✅ RESOLVEDinside the Resolution section has been removed. The finding header already carries the status.packages/fenliu/Security-Audit-detail.mdline 481✅ Fixed in commit
ef69f49— duplicate removed from the Resolution section.packages/fenliu/Security-Audit-detail.mdline 539✅ Fixed in commit
ef69f49— L3 header status unified toAccepted / Won't Fixto match L4.packages/fenliu/Security-Audit-detail.mdline 556✅ Fixed in commit
ef69f49— L3 header unified toAccepted / Won't Fix.packages/fenliu/Security-Audit-detail.mdline 561✅ Text clarified in commit
ef69f49. The resolution now states explicitly that the finding does not apply — the described vulnerability (API key printed to stdout) was never present in the implementation. There is no risk to accept.Accepted / Won't Fixis kept as the standard audit disposition for a finding closed without a code change, but the body now makes clear the reason is inapplicability rather than risk tolerance.packages/fenliu/Security-Audit-detail.mdline 543🔴 Not actioned — the format is correct and intentional.
add_blocked_hashtaglogs two arguments: the hashtag name and the client IP ("Blocked hashtag added: %s; client=%s").add_blocked_userlogs three (identifier, pattern_type, client IP) because user blocks carry apattern_typefield that hashtag blocks do not have. The argument count differs because the handler signatures differ, not because of an inconsistency.packages/fenliu/entrypoint.shline 31✅ Confirmed. The
0o027umask is exactly the intended security control for audit finding L1 (log file permissions). Good to have independent validation that the choice is sound.