nesquena-hermes
96ca83bf53
fix(security): drop unsafe-eval + add jsdelivr to CSP, sanitize plugin error
...
Opus stage-339 review SHOULD-FIX items:
1. server.py: drop 'unsafe-eval' from CSP report-only policy.
Verified by grepping all production JS — zero matches for eval(),
new Function(), or string-form setTimeout/setInterval. Keeping it
was a gratuitous privilege.
2. server.py: add https://cdn.jsdelivr.net to script-src + style-src.
index.html loads Prism/xterm/katex from this CDN with SRI hashes —
without the allowance every page load fires known-good CSP violations
that drown out real signal once a collector is wired.
3. api/commands.py: sanitize plugin command error. Previously returned
f'Plugin command error: {exc}' which would leak paths/env from
FileNotFoundError('/etc/something/secret.key') etc. Now returns only
the exception type name; full traceback goes to server log.
Test asserts updated to match the new policy shape.
Co-authored-by: Opus advisor <opus-advisor@hermes.local >
2026-05-11 17:53:02 +00:00
..
2026-05-11 06:15:46 +00:00
2026-05-10 18:03:21 +02:00
2026-05-10 10:15:16 -07:00
2026-05-09 18:33:28 +00:00
2026-05-10 18:07:50 +00:00
2026-05-10 17:13:52 +00:00
2026-05-11 09:42:40 -07:00
2026-05-11 06:18:13 +00:00
2026-05-11 17:24:53 +08:00
2026-05-08 16:40:16 +00:00
2026-05-09 19:17:34 +00:00
2026-05-11 17:09:19 +02:00
2026-05-10 15:21:24 +08:00
2026-05-08 20:48:39 +00:00
2026-05-10 18:00:10 +02:00
2026-05-05 01:12:07 +00:00
2026-05-08 20:48:39 +00:00
2026-04-25 14:33:41 -07:00
2026-05-09 02:15:35 +02:00
2026-05-08 16:07:48 +00:00
2026-05-09 02:15:35 +02:00
2026-04-30 16:20:05 +00:00
2026-05-11 20:31:00 +08:00
2026-05-11 20:31:00 +08:00
2026-04-26 18:47:38 -07:00
2026-05-11 07:33:52 +08:00
2026-05-01 19:52:05 +08:00
2026-05-01 18:30:41 +00:00
2026-04-30 23:24:31 +00:00
2026-05-11 07:33:52 +08:00
2026-05-11 02:55:50 +00:00
2026-05-11 07:33:52 +08:00
2026-05-02 00:21:15 +00:00
2026-05-04 04:51:30 +00:00
2026-05-11 05:59:42 +00:00
2026-05-11 07:33:52 +08:00
2026-05-08 16:40:16 +00:00
2026-05-11 07:33:52 +08:00
2026-05-11 07:33:52 +08:00
2026-05-04 16:17:26 +00:00
2026-05-04 16:03:05 +00:00
2026-05-10 10:31:14 -06:00
2026-05-04 16:49:43 +00:00
2026-05-09 02:15:35 +02:00
2026-05-06 16:11:46 +00:00
2026-05-08 20:48:43 +00:00
2026-05-08 13:32:05 +08:00
2026-05-09 10:36:30 -07:00
2026-05-11 02:55:50 +00:00
2026-05-10 20:44:34 +08:00
2026-05-08 19:58:21 +00:00
2026-05-09 14:53:42 +08:00
2026-05-08 20:48:39 +00:00
2026-05-11 17:53:02 +00:00
2026-05-08 20:48:41 +00:00
2026-05-08 16:40:17 +00:00
2026-05-08 21:14:22 -07:00
2026-05-11 12:51:57 +08:00
2026-05-11 12:12:40 +08:00
2026-05-09 20:08:16 +00:00
2026-05-10 14:25:08 +08:00
2026-05-11 19:12:02 +08:00
2026-05-11 19:12:02 +08:00
2026-05-11 07:33:52 +08:00
2026-05-11 20:56:30 +08:00
2026-05-11 07:03:17 +08:00
2026-05-11 21:53:43 +08:00
2026-05-09 15:08:13 +08:00
2026-05-11 12:38:48 +00:00
2026-05-11 15:40:49 +00:00
2026-05-08 20:26:11 +00:00
2026-05-11 16:30:25 +08:00
2026-05-11 02:03:37 +02:00
2026-05-10 19:12:20 +10:00
2026-05-11 17:24:53 +08:00
2026-05-08 21:16:17 +00:00
2026-05-08 20:48:44 +00:00
2026-05-08 21:16:21 +00:00
2026-05-11 09:13:25 +02:00
2026-05-09 18:15:50 +00:00
2026-05-11 06:06:58 +00:00
2026-04-25 23:28:29 -07:00
2026-05-11 17:24:53 +08:00
2026-05-10 12:18:02 -07:00
2026-05-08 23:51:24 +02:00
2026-05-11 02:03:37 +02:00
2026-05-09 16:16:32 +08:00
2026-05-11 02:15:00 +02:00
2026-05-11 16:30:25 +08:00
2026-05-08 21:16:21 +00:00
2026-05-11 10:46:17 +08:00
2026-05-09 10:03:27 +08:00
2026-05-10 17:04:33 +02:00
2026-05-11 08:14:50 +08:00
2026-05-11 17:15:22 +08:00
2026-05-11 17:15:22 +08:00
2026-05-11 16:30:25 +08:00
2026-05-11 02:06:43 +02:00
2026-05-11 13:09:16 +08:00
2026-05-10 21:57:47 -07:00
2026-04-22 16:27:01 +00:00
2026-05-10 16:05:50 +08:00
2026-05-10 16:45:16 +08:00
2026-05-09 18:36:01 +00:00
2026-05-09 18:36:01 +00:00
2026-05-11 06:00:13 +00:00
2026-05-08 16:40:16 +00:00
2026-05-08 20:48:43 +00:00
2026-05-09 02:15:35 +02:00
2026-05-08 23:51:24 +02:00
2026-05-11 17:16:43 +02:00
2026-05-11 17:16:43 +02:00
2026-05-11 09:13:25 +02:00
2026-05-11 17:16:43 +02:00
2026-05-05 03:13:55 -07:00
2026-05-08 16:55:20 +00:00
2026-05-09 09:53:38 +08:00