Harden dependency audit gate, assignment attribution, and CSP - #8
Merged
Conversation
Closes out the remaining gaps from the hardening review: cargo-audit previously only failed on Vulnerability-class findings, so an unsound anyhow advisory (RUSTSEC-2026-0190) rode along silently. The assignment audit trail (confirmedBy/updatedBy) was sourced from %USERNAME%-style env vars, which anything can set before launching the app. And the CSP carried unsafe-inline for styles that the renderer never actually needs. - Bump transitive anyhow 1.0.102 -> 1.0.103 (fixes RUSTSEC-2026-0190); add .cargo/audit.toml documenting the remaining inapplicable/unmaintained advisories (Linux-only GTK bindings, build-time-only proc-macro, unmaintained Unicode helper crates); tighten CI to `cargo audit --deny warnings` so future advisories can't ride along unnoticed. - Replace env-var-derived assignment attribution with the OS-authenticated identity via GetUserNameExW/GetComputerNameExW (windows-sys, already transitively resolved through tauri's stack), with the previous env-var logic kept as a per-field fallback. Verified live: sidebar now shows the real logged-in identity and domain instead of a spoofable env var. - Add object-src 'none' and base-uri 'self' to the CSP; drop the now- unnecessary style-src 'unsafe-inline' (all dynamic styling goes through CSSOM property assignment, which CSP's style-src doesn't gate). Verified live via a real tauri dev build that the dashboard's colored bars, avatars, and status dots still render correctly. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to a full hardening review of HardView (rated 9/10). Closes the three remaining gaps found there:
cargo auditwas a soft gate. It only fails CI onVulnerability-class findings, notunmaintained/unsoundwarnings — 18 of the latter (incl.RUSTSEC-2026-0190, unsoundness inanyhow::Error::downcast_mut(), published days before the review) were passing silently.anyhowis bumped 1.0.102 → 1.0.103 (transitive via tauri, fixes the advisory outright); the remaining 17 are Linux-only GTK bindings, a build-time-only proc-macro crate, and unmaintained Unicode helpers — none reachable on this Windows-only target — now explicitly documented and ignored inapp/src-tauri/.cargo/audit.toml. CI now runscargo audit --deny warnings, so any future advisory not on that curated list fails the build instead of riding along.confirmedBy/updatedByinassignments.jsonwas sourced from%USERNAME%/%USERDOMAIN%env vars, which anything can set before launching the app. Now sourced from the OS-authenticated identity viaGetUserNameExW/GetComputerNameExW(windows-sys, already transitively resolved through tauri's own dependency tree — no new supply-chain surface), with the previous env-var logic kept as a per-field fallback for robustness.unsafe-inline. Addedobject-src 'none'andbase-uri 'self'. Droppedstyle-src 'unsafe-inline'— verified no code relies on thestyleattribute/setAttribute('style', ...)/cssText; all dynamic styling goes through per-property CSSOM assignment, which CSP'sstyle-srcdoesn't gate.Test plan
cargo fmt --all -- --checkcargo clippy --all-targets -- -D warningscargo test --all(25/25, incl. a new smoke test for the identity lookup)cargo audit --deny warnings(clean)npm run check/npm test(5/5)tauri devbuild with sample data: dashboard status dots, RAM bars, and avatar backgrounds (all inline-styled) render correctly; sidebar now shows the real authenticated Windows identity/domain instead of the previous env-var-derived value.🤖 Generated with Claude Code