Martin Vogel
cd1417427c
Code-level defenses: - cbm_validate_shell_arg(): reject shell metacharacters before popen/system - SQLite authorizer: block ATTACH/DETACH at engine level - CORS localhost-only origin reflection (replaces wildcard *) - Path containment: realpath() check in get_code_snippet - process-kill restricted to server-spawned PIDs - SHA256 checksum verification in update command Security audit scripts (8 layers): - L1: Static allow-list for dangerous calls + URLs - L2: Binary string audit (URLs, payloads, credentials) - L3: Network egress monitoring via strace (Linux) - L4: Install output path + content validation - L5: Smoke test hardening (clean shutdown, residual procs) - L6: Graph UI audit (external domains, CORS, binding) - L7: MCP robustness (23 adversarial JSON-RPC payloads) - L8: Vendored integrity (checksums + dangerous call scan) CI: parallel security-static job (no build needed), binary layers in smoke jobs per-platform. Cleanup of test fixture dirs in clean.sh + .gitignore.
36 lines
1.1 KiB
Bash
Executable File
36 lines
1.1 KiB
Bash
Executable File
#!/bin/bash
|
|
# clean.sh — Remove ALL build artifacts, caches, and generated files.
|
|
#
|
|
# Usage: scripts/clean.sh
|
|
#
|
|
# Ensures every subsequent build starts from scratch — no cached .o files,
|
|
# no stale node_modules, no leftover dist folders. This is the first step
|
|
# in both scripts/test.sh and scripts/build.sh.
|
|
|
|
set -euo pipefail
|
|
|
|
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
|
|
|
|
echo "=== Cleaning build artifacts ==="
|
|
|
|
# C build artifacts
|
|
rm -rf "$ROOT/build/c"
|
|
|
|
# Frontend build artifacts
|
|
rm -rf "$ROOT/graph-ui/dist"
|
|
rm -rf "$ROOT/graph-ui/node_modules"
|
|
|
|
# Root-level node artifacts (if any)
|
|
rm -rf "$ROOT/node_modules"
|
|
|
|
# Generated embedded assets (regenerated by embed-frontend.sh)
|
|
rm -f "$ROOT/src/ui/embedded_assets.c"
|
|
|
|
# Leftover test fixture dirs (C test suite sometimes creates these in CWD)
|
|
find "$ROOT" -maxdepth 1 -type d \( -name 'cbm_*' -o -name 'cli-*' \) -exec rm -rf {} + 2>/dev/null || true
|
|
|
|
# Leftover test fixture dirs in /tmp
|
|
find /tmp -maxdepth 1 -type d \( -name 'cbm_*' -o -name 'cli-*' \) -user "$(id -u)" -exec rm -rf {} + 2>/dev/null || true
|
|
|
|
echo "=== Clean complete ==="
|