cgalo5758
5829091881
The contained runner that drove the 2026-09 security audit, the README review and four rounds of design ideation lived only inside the ignored notebook. It moves to scripts/agent-runner/: the prepare, tools, audit, ideation and teardown scripts, the compose and container files, the allowlist proxy and the prompt templates, with the paths that assumed the notebook fixed and findings written to a caller-named directory. Run outputs, transcripts and the round-specific sheet scripts stay behind. docs/agent-runner.md states the method: the disposable git archive copy and the fail-closed proxy, how a task is shaped, union rather than intersection of findings across models, separate adjudication of every finding against the source, and the evidence a finding must carry.
26 lines
1.3 KiB
Markdown
26 lines
1.3 KiB
Markdown
# T07 — Response headers and template rendering
|
|
|
|
**Threat model.** An attacker who can get text into a page tries to execute
|
|
script in another person's browser, or to frame or downgrade the application.
|
|
|
|
**Slice.** `internal/middleware/security.go`, `internal/server/render.go`,
|
|
the error-page and static-asset paths in `internal/server/server.go`, and a
|
|
survey of `internal/embeds/templates/` for how untrusted values are emitted.
|
|
|
|
**Questions.**
|
|
1. Reproduce the CSP as served. Does every source list actually match what the
|
|
application loads today? Is any entry broader than it needs to be, and could
|
|
an attacker serve script from anything it permits?
|
|
2. Does the project's stated no-inline-script rule hold in the templates, or
|
|
are there inline handlers or inline `<script>` blocks?
|
|
3. Is any value rendered through `template.HTML`, `template.JS`, `template.URL`,
|
|
or `text/template`, and can attacker-controlled data reach it?
|
|
4. Do error pages, static assets, partial responses, and integration-mounted
|
|
routes all receive the security headers, or can a response bypass the
|
|
middleware?
|
|
5. Are the HSTS parameters appropriate for a production deployment behind TLS?
|
|
6. Does any handler write user input into a header, a redirect target, or a
|
|
cookie value without encoding?
|
|
|
|
**Not in scope.** CSRF token mechanics (T01, T03).
|