fix(security): 🛡️ harden management endpoints and fix secret scanner#577
Conversation
- Restrict access to sensitive Actuator endpoints (/management/info, /management/prometheus) to ADMIN role. - Remove malformed and sensitive "actuator/info" entry from permitAll list. - Fix scripts/check-secrets.sh by updating architecture mapping to x64 and correcting checksum file URL logic for Gitleaks v8.30.0. - Update Sentinel journal with security findings and fixes. Co-authored-by: yacosta738 <33158051+yacosta738@users.noreply.github.com>
Deploying cvix with
|
| Latest commit: |
b4978a9
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://be8283a1.cvix.pages.dev |
| Branch Preview URL: | https://fix-security-hardening-actua.cvix.pages.dev |
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
github-actions
bot
added
area:backend
📝 WalkthroughSummary by CodeRabbit
WalkthroughGitleaks installation script enhanced with improved architecture mapping, checksum file handling, and directory initialization. Management endpoints (actuator/info, management/info, management/prometheus) restricted from public access, requiring authentication. Changes
Estimated Code Review Effort🎯 2 (Simple) | ⏱️ ~12 minutes Suggested Labels
Poem
🚥 Pre-merge checks | ✅ 5 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
✅ Contributor ReportUser: @yacosta738
Contributor Report evaluates based on public GitHub activity. Analysis period: 2025-02-12 to 2026-02-12 |
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
scripts/check-secrets.sh (1)
29-39: 🛠️ Refactor suggestion | 🟠 MajorDownloaded artifacts are never cleaned up after installation.
The tarball, checksums file, and
.sha256file remain in the current working directory after installation completes. In CI pipelines this leaves unnecessary artifacts; in local runs it pollutes whatever directory the script is invoked from. Use a temporary directory and clean up on exit.♻️ Proposed fix: use a temp directory with trap-based cleanup
+WORK_DIR="$(mktemp -d)" +trap 'rm -rf "$WORK_DIR"' EXIT + if ! command -v gitleaks >/dev/null 2>&1; then echo -e "${YELLOW}🔍 gitleaks not found, installing to $INSTALL_DIR...${RESET}" - curl -sSL -O "$TARBALL_URL" - curl -sSL -O "$CHECKSUMS_URL" - grep "$TARBALL" "$CHECKSUMS_FILE" > "${TARBALL}.sha256" - sha256sum -c "${TARBALL}.sha256" - tar -xzf "$TARBALL" gitleaks + curl -sSL -o "$WORK_DIR/$TARBALL" "$TARBALL_URL" + curl -sSL -o "$WORK_DIR/$CHECKSUMS_FILE" "$CHECKSUMS_URL" + grep -F "$TARBALL" "$WORK_DIR/$CHECKSUMS_FILE" > "$WORK_DIR/${TARBALL}.sha256" + ( cd "$WORK_DIR" && sha256sum -c "${TARBALL}.sha256" ) + tar -xzf "$WORK_DIR/$TARBALL" -C "$WORK_DIR" gitleaks + mv "$WORK_DIR/gitleaks" "$INSTALL_DIR/" - mv gitleaks "$INSTALL_DIR/" chmod +x "$INSTALL_DIR/gitleaks" export PATH="$INSTALL_DIR:$PATH" echo -e "${GREEN}✅ gitleaks installed successfully!${RESET}"Note the addition of
-Ftogrep— the tarball filename contains dots which are regex wildcards. Using fixed-string matching is more precise.
🤖 Fix all issues with AI agents
In `@scripts/check-secrets.sh`:
- Line 33: The grep invocation that extracts the checksum uses pattern matching
and should use fixed-string mode to avoid interpreting dots or other
metacharacters in $TARBALL as regex; update the command that runs grep
"$TARBALL" "$CHECKSUMS_FILE" > "${TARBALL}.sha256" to use fixed-string matching
(e.g., add -F or --fixed-strings) so the tarball name is matched literally
against $CHECKSUMS_FILE.
| curl -sSL -O "$TARBALL_URL" | ||
| curl -sSL -O "$CHECKSUMS_URL" | ||
| grep "$TARBALL" checksums.txt > "${TARBALL}.sha256" | ||
| grep "$TARBALL" "$CHECKSUMS_FILE" > "${TARBALL}.sha256" |
There was a problem hiding this comment.
Use grep -F for fixed-string matching.
The tarball name contains literal dots (e.g., gitleaks_8.30.0_linux_x64.tar.gz). Without -F, grep interprets those as regex wildcards matching any character. While unlikely to cause a false match in this checksums file, it's a correctness gap that's trivially fixed.
🐛 Proposed fix
- grep "$TARBALL" "$CHECKSUMS_FILE" > "${TARBALL}.sha256"
+ grep -F "$TARBALL" "$CHECKSUMS_FILE" > "${TARBALL}.sha256"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| grep "$TARBALL" "$CHECKSUMS_FILE" > "${TARBALL}.sha256" | |
| grep -F "$TARBALL" "$CHECKSUMS_FILE" > "${TARBALL}.sha256" |
🤖 Prompt for AI Agents
In `@scripts/check-secrets.sh` at line 33, The grep invocation that extracts the
checksum uses pattern matching and should use fixed-string mode to avoid
interpreting dots or other metacharacters in $TARBALL as regex; update the
command that runs grep "$TARBALL" "$CHECKSUMS_FILE" > "${TARBALL}.sha256" to use
fixed-string matching (e.g., add -F or --fixed-strings) so the tarball name is
matched literally against $CHECKSUMS_FILE.
1 participant
This PR addresses two security-related issues:
/management/infoand/management/prometheusendpoints were previously configured withpermitAll(), exposing internal metrics and build information to unauthorized users. These have been restricted to theADMINrole.scripts/check-secrets.shscript was failing to installgitleaksdue to an incorrect architecture mapping and a missing checksum file. This has been fixed to ensure secret scanning is functional in the CI/CD pipeline.All changes are well within the 50-line limit for Sentinel tasks. Verification was performed using
make _verify-backend-checkandmake _verify-secrets.PR created automatically by Jules for task 16328807985855626231 started by @yacosta738