30 lines
1.6 KiB
Markdown
30 lines
1.6 KiB
Markdown
|
# Security Review & OWASP Verification Checklist
|
|||
|
|
|
|||
|
|
## Input Validation & Boundaries
|
|||
|
|
- [ ] Pydantic schemas enforce hard string bounds (max 50,000 for text, max 200 for titles).
|
|||
|
|
- [ ] Dynamic path/query identifiers validated via `sanitize_identifier()`.
|
|||
|
|
- [ ] Pagination limits clamped to `1 <= limit <= 50`.
|
|||
|
|
- [ ] Batch array inputs clamped to safe upper bounds (max 100–200 items).
|
|||
|
|
|
|||
|
|
## Four-Pillar Upload Defense
|
|||
|
|
- [ ] Uploads restricted by `DEFAULT_MAX_FILE_SIZE` (100MB; 5MB for images).
|
|||
|
|
- [ ] Blocked executable extensions rejected (`BLOCKED_EXTENSIONS`).
|
|||
|
|
- [ ] Extension checked against `ALLOWED_EXTENSIONS`.
|
|||
|
|
- [ ] Header magic bytes inspected (`check_magic_bytes`) to block disguised binaries.
|
|||
|
|
- [ ] Filenames sanitized with `sanitize_filename()` (path traversal and CLI injection stripped).
|
|||
|
|
- [ ] Disk writes resolved strictly via `safe_resolve_path()`.
|
|||
|
|
|
|||
|
|
## SSRF Defense
|
|||
|
|
- [ ] All outbound requests in research/web-retrieval validated with `validate_safe_url()`.
|
|||
|
|
- [ ] Loopback (`127.0.0.1`), private RFC 1918 subnets, and cloud metadata (`169.254.169.254`) blocked.
|
|||
|
|
- [ ] Scheme restricted strictly to `http` and `https`.
|
|||
|
|
|
|||
|
|
## Secrets & Data Hygiene
|
|||
|
|
- [ ] Zero API keys, bearer tokens, or password hashes written to `error_log` or logs.
|
|||
|
|
- [ ] Authorization headers masked in logging formatters (`Bearer ***`).
|
|||
|
|
- [ ] Production error responses mask internal database paths and raw tracebacks.
|
|||
|
|
|
|||
|
|
## Authorization & State Safety
|
|||
|
|
- [ ] Mutations verify that target records match the active session / conversation scope.
|
|||
|
|
- [ ] SQLite queries use parameterized SQL; no raw string concatenation.
|
|||
|
|
- [ ] Rate limits applied on expensive inference and digestion endpoints.
|