Skip to content

Harden cdidx report bundles - #2924

Merged
Widthdom merged 3 commits into
mainfrom
fix-issue2836-2840-2841
Jun 2, 2026
Merged

Harden cdidx report bundles#2924
Widthdom merged 3 commits into
mainfrom
fix-issue2836-2840-2841

Conversation

@Widthdom

@Widthdom Widthdom commented Jun 2, 2026

Copy link
Copy Markdown
Owner

Summary

  • Redact report schema database paths and lifecycle-log source paths.
  • Redact path-bearing lifecycle fields (process_path=, base_dir=, cwd=, db=, path=) while preserving --include-args as the explicit opt-in for literal args=.
  • Write report archives and tar entries with owner-only POSIX permissions.

Validation

  • dotnet restore CodeIndex.sln --locked-mode
  • dotnet build
  • dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~ReportCommandRunnerTests" -p:UseSharedCompilation=false
  • dotnet test -p:UseSharedCompilation=false
  • dotnet run --project tools/CodeIndex.Changelog -- check
  • dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll status --check --json
  • Codex adversarial review against origin/main; findings addressed.

Docs / Changelog

  • Updated USER_GUIDE.md.
  • Added changelog.d/unreleased/2836.security.md.
  • Added changelog.d/unreleased/2840.security.md.
  • Added changelog.d/unreleased/2841.security.md.

Follow-up

Fixes #2836
Fixes #2840
Fixes #2841

@Widthdom
Widthdom marked this pull request as ready for review June 2, 2026 06:14
@Widthdom
Widthdom merged commit 85f84f6 into main Jun 2, 2026
10 checks passed
@Widthdom
Widthdom deleted the fix-issue2836-2840-2841 branch June 2, 2026 06:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

1 participant