salman
5a8bd70957
- P0 path-traversal fix: run-name class is dot-free with \z anchors, so '.', '..', and %0A-trailing values can never escape TRIMSP_TMPROOT. The deployed path allowlist is derived from the configured root instead of the old hardcoded /tmp prefix. - Replacing external with an alarm() watchdog that kills the engine's whole process group (setpgrp + kill KILL -pid), matching muSRFlow; describe_result maps -2/-1/signal to 124/127/128+sig. - prune_stale_jobs() ages out dirs (TrimSP.cfg marker only), orphaned .tgz, and leaked per-request logs; safe in shared /tmp (symlinks skipped, remove_tree safe mode, never touches non-trimsp dirs). - Archive is serialized per run with flock (.trimsp-lock); per-point engine runs stay concurrent. - Symlink/non-dir run dirs refused; mode 0700 so results are not world-readable. read/download also reject symlinked targets. - Request caps: MAX_REQUEST_LINES 20000, MAX_REQUEST_BYTES 4 MiB -> 413. - action=health deployment self-check; env overrides TRIMSP_BIN, TMPROOT, CMD_TIMEOUT, JOB_MAXAGE (sed anchor for the binary path kept intact). - Wire contract preserved: ok/phase/message/exitCode/archiveUrl/log JSON, text read, gzip download, real HTTP statuses. No TrimSPweb.js change. - New tests/cgi-tests.sh drives the real CGI offline (18 cases: traversal, %0A, escaping round-trip, success/fail/hang engine, 124 watchdog, archive+- download, pruner, symlink refusal, 413). deploy-web.sh now verifies the sed substitution embedded the selected engine path.
35 lines
2.2 KiB
Plaintext
35 lines
2.2 KiB
Plaintext
Seed handling and input hardening (deferred from the B-list fixes)
|
|
=====================================================================
|
|
|
|
- Validate ranSeed in the GUI and startSequence: it must be an integer in a
|
|
safe range (e.g. -2^31 .. 2^31-1) if a fixed seed is requested. Blocks a
|
|
crafted share link from injecting a garbage seed value into the input deck.
|
|
- Derive per-scan-point seeds deterministically from the base seed and the
|
|
scan index, so a multi-point run is reproducible in any finish order
|
|
(currently: initialSeed + iScan, but only when the user set a seed).
|
|
- Warn when a shared configuration fixed the RanSeed: every scan point then
|
|
uses the same generator, which can produce statistically misleading results.
|
|
- Cap client-controlled magnitudes: numberProj (projectile count) and
|
|
valEnergy must be upper-bounded from share links before the engine runs, to
|
|
prevent an accidental or malicious "run forever / write enormous .rge" job.
|
|
- Consider persisting the effective per-point seed back into the *.seq output
|
|
metadata so results self-document their RNG state.
|
|
|
|
Deferred follow-ups from the C-list CGI hardening
|
|
=================================================
|
|
|
|
- The perl "Statement unlikely to be reached" warning at the exec/_exit(127)
|
|
child branch of run_bounded_command is intentional (matching muSRFlow) and
|
|
does not affect `perl -c`; tests run with -X to keep output clean.
|
|
- No global concurrency cap is implemented (by design, mirroring muSRFlow):
|
|
concurrent per-point engine runs are allowed; archive is serialized per run
|
|
with flock. Revisit if a runaway share link floods scan points.
|
|
- Auth (MUCH-need, muSRFlow parity): none is implemented, keeping the read-only
|
|
/tmp contract. If this CGI is ever exposed beyond a trusted LAN, gate it with
|
|
httpd authentication or a shared-token header.
|
|
- Restart integration (retch): the watchdog returns exit code 124 and the JSON
|
|
"log" carries the description; a deployment that wants automated retries can
|
|
key off exitCode === 124 and re-post the same .inp.
|
|
- A future client change could surface TRIMSP_TMPROOT behind a shared
|
|
configuration; the browser path regex is derived from the same env var, so
|
|
both sides stay consistent. |