The unequal-length branch of timingSafeCompare called
crypto.timingSafeEqual(paddedA, paddedB) but did not capture the return
value, unconditionally returning false and leaving the timing-safe
comparison as dead code.
Adds a regression test covering shorter, longer, and exact-match
credential lengths to lock in the correct behaviour.
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
- Fix timingSafeCompare to pad buffers to equal length before comparing,
closing the content timing side-channel on length mismatch
- Replace innerHTML with textContent for error messages to prevent XSS
- Extract inline script from dashboard/index.html into dashboard/app.js
- Remove 'unsafe-inline' from script-src CSP directive
- Update security test to match new CSP policy
https://claude.ai/code/session_01GfwUNbgeMgXreFDbsNQMsS
- Refactored `test/memory-scheduler.test.mjs` to use `mock.timers` for deterministic execution, replacing flaky `wait` logic.
- Strengthened `test/lock-ops.test.mjs` with edge case tests for `parseLockEvent` handling invalid JSON and missing fields.
- Fixed a security vulnerability in `src/dashboard.mjs` where sensitive configuration (e.g., rosters, auth) was exposed in `/torch-config.json`.
- Updated `src/prompts/daily/test-audit-agent.md` to comply with the canonical prompt contract.
- Added `reports/test-audit/test-integrity-note-2025-02-14.yaml` detailing test changes and anti-cheat measures.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Replaced brittle regex-based sanitization with `path.resolve` relative to `packageRoot`.
- Added `test/dashboard-path-traversal-fix.test.mjs` to verify robust protection against traversal attacks.
- Verified that legitimate access to allowed paths is maintained.
- Verified that access to restricted files (like package.json) is blocked.
- Updated path handling to correctly handle absolute paths and URL-encoded characters.
This change addresses a potential security vulnerability where the previous sanitization logic could be bypassed in certain environments or with specific edge cases. By using standard path resolution and explicitly checking against a canonical root, the implementation is more secure and maintainable.
Co-authored-by: PR0M3TH3AN <[email protected]>
Restrict the /torch-config.json endpoint to only return fields required by the dashboard frontend (dashboard config excluding auth, and nostrLock namespace/relays). This prevents exposure of sensitive internal configuration such as rosters, scheduler settings, and full relay lists.
- Modify src/dashboard.mjs to sanitize config using an allowlist approach.
- Add test/dashboard-config-exposure.test.mjs to verify sensitive fields are stripped.
Co-authored-by: PR0M3TH3AN <[email protected]>
Adds standard HTTP security headers (CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy) to all dashboard responses to mitigate XSS, clickjacking, and MIME sniffing attacks.
Includes verification tests in test/dashboard-security.test.mjs.
Co-authored-by: PR0M3TH3AN <[email protected]>
`frontend-console-debug-agent` run:
- Fixed a 403 Forbidden error in `src/dashboard.mjs` preventing `src/constants.mjs` from loading by adding it to the `allowedPaths` whitelist.
- Refactored `src/lock-ops.mjs` to fix a critical syntax error in `LockPublisher` class.
- Fixed a typo in `src/cmd-check.mjs` (`queryLocksFn` -> `queryLocks`).
- Added `@playwright/test` for frontend debugging.
- Added `scripts/agent/debug_frontend.mjs` for reproduction.
Co-authored-by: PR0M3TH3AN <[email protected]>
Replaces synchronous `fs.readFileSync` with `fs.promises.readFile` in `loadTorchConfig` to prevent event loop blocking.
Updates all dependent configuration getters and consumers to use async/await.
Includes benchmark proving non-blocking behavior.
Fixes dashboard tests to properly await server listening.
Co-authored-by: PR0M3TH3AN <[email protected]>
The dashboard previously served the raw `torch-config.json` file, potentially exposing sensitive information like authentication credentials.
This commit modifies the `/torch-config.json` endpoint to:
1. Parse the configuration file.
2. Sanitize the output by removing the `dashboard.auth` field and any unknown fields (using `parseTorchConfig`).
3. Support `TORCH_CONFIG_PATH` environment variable for configuration file location, improving testability and consistency with other components.
Verified with new test `test/dashboard-config-security.test.mjs` and existing auth tests.
Co-authored-by: PR0M3TH3AN <[email protected]>
This patch addresses a security vulnerability where the dashboard server could serve any file from the package root.
Changes:
- Implemented an allowlist in `src/dashboard.mjs` to restrict file access to:
- `dashboard/`
- `assets/`
- `src/docs/`
- `torch-config.json`
- Added `test/dashboard-security.test.mjs` to verify the fix and prevent regressions.
The fix ensures that sensitive files like `package.json` or source code cannot be accessed via the dashboard server.
Co-authored-by: PR0M3TH3AN <[email protected]>
This commit addresses the missing authentication vulnerability in the
dashboard server.
Changes:
- Added Basic Authentication support via TORCH_DASHBOARD_AUTH env var
or dashboard.auth config field.
- Defaulted dashboard host binding to 127.0.0.1 for better security.
- Added --host CLI argument to allow overriding the bind address.
- Used crypto.timingSafeEqual for secure credential comparison.
- Fixed a potential crash when parsing malformed Authorization headers.
- Added comprehensive unit tests for dashboard authentication.
- Updated documentation in README.md and torch-config.example.json.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Fix multiple syntax errors in `src/lib.mjs` (redundant declarations, broken loops, missing imports).
- Fix syntax error in `src/dashboard.mjs` (invalid catch block).
- Remove redundant local function definitions in `src/lib.mjs` in favor of imports from `src/torch-config.mjs` and `src/utils.mjs`.
- Update `landing/index.html` installation command to include `npx torch-lock init` step.
- Verify `torch-lock init` works correctly.
- Ensure all tests pass and linting is clean for `src/lib.mjs`.
Co-authored-by: PR0M3TH3AN <[email protected]>
