scriptoriumadmin/GitNexus
1
0
Fork 0
mirror of https://github.com/abhigyanpatwari/GitNexus.git synced 2026-09-07 08:26:11 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 11
458 commits 112 branches 901 tags 305 MiB
Commit graph

5 commits

Author SHA1 Message Date
jreakin
57e087de49 fix(web): strip quoted strings before readOnly keyword check 
The readOnly guard was matching keywords inside string literals,
blocking legitimate queries like WHERE n.name CONTAINS "delete".
Now strips single/double-quoted strings before checking, so only
actual Cypher write keywords outside strings are blocked.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-23 05:09:44 -05:00
jreakin
fc6c114570 fix(web): MermaidDiagram XSS, isSafeId allows @, rawMermaid typed 
- Add DOMPurify.sanitize() to MermaidDiagram.tsx dangerouslySetInnerHTML
  (was rendering AI-generated SVG unsanitized — the highest-risk surface)
- Add @ to isSafeId regex for scoped npm packages (@angular/core, etc.)
- Add rawMermaid to ProcessData interface, remove (process as any) casts
- Update security tests: @scope/pkg now accepted, @angular/core added

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-23 05:01:57 -05:00
jreakin
208ade9b11 fix: add / back to isSafeId — node IDs contain file paths 
Node IDs are generated as Label:filePath (e.g., Function:src/foo.ts:bar),
so forward slashes are expected in legitimate IDs. The over-tightened
regex was dropping all path-based IDs from Cypher queries.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-23 04:45:09 -05:00
jreakin
9f14edc226 fix(web): security hardening — Cypher injection, XSS, readOnly, prepared statements 
- DOMPurify.sanitize() on mermaid SVG in ProcessFlowModal
- validLabel()/validRelType() guards on all Cypher interpolation in tools.ts
- isSafeId() strict regex in ProcessesPanel (no spaces/slashes/metacharacters)
- executeQuery defaults readOnly=true (rejects CREATE/DELETE/DROP/etc.)
- Singleton promise for initLbug (prevents concurrent init races)
- Prepared statements for relation inserts (batched by label pair)
- executeWithReusedStatement for enrichment updates
- try/finally on all PreparedStatement cleanup
- 99 security guard tests (validLabel, validRelType, isSafeId, readOnly regex)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-23 04:45:09 -05:00
jreakin
ee78ebe64a test: add positive and negative tests for all 4 bug fixes 
16 tests covering the data structures and logic underlying each fix:

createKnowledgeGraph (loadServerGraph data flow):
  + nodes stored correctly via addNode
  + relationships stored correctly via addRelationship
  + deduplication by ID
  + nodeCount reflects unique count
  - empty graph has zero counts
  - relationships with non-existent nodes still stored

loadServerGraph data flow:
  + server data reconstructs into valid KnowledgeGraph
  + fileContents Map built from server entries
  - empty server data produces empty graph
  - fileContents replaces (not accumulates) on reload

BM25 index argument type:
  + Map<string, string> has entries() for BM25
  - KnowledgeGraph does NOT have entries() (the original bug)

Highlight clearing:
  + clearing Set produces empty set
  + independent highlight sources cleared separately
  - clearing highlights doesn't affect node selection
  - toggling AI ON doesn't clear process highlights

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-23 03:48:27 -05:00