139 lines
4.1 KiB
Markdown
139 lines
4.1 KiB
Markdown
# Skill: Security Hardening
|
||
|
||
## Когда использовать
|
||
|
||
Используй этот skill при изменениях, связанных с Tauri security, CSP, secrets, subscription fetching, process execution, PowerShell, temporary files, install/uninstall, file writes, generated configs, service control, logs, diagnostics.
|
||
|
||
## Threat model
|
||
|
||
ProxyWarden — desktop app that can influence network routing and run elevated Windows operations. Главные риски:
|
||
|
||
- leaking proxy/subscription credentials;
|
||
- unsafe local/network fetches;
|
||
- unsafe generated elevated PowerShell scripts;
|
||
- unscoped process execution;
|
||
- corrupting generated/service configs;
|
||
- deleting wrong directories;
|
||
- stale component status causing wrong actions;
|
||
- XSS/webview compromise amplified by privileged backend commands.
|
||
|
||
## Non-negotiables
|
||
|
||
- `tauri.conf.json` must not use `"csp": null` as final state.
|
||
- Do not add broad Tauri shell permissions.
|
||
- Do not execute user-controlled strings as commands.
|
||
- Do not log full subscription URLs, proxy passwords, userinfo, access tokens, or outbound configs with credentials.
|
||
- Do not recursively delete directories based only on fuzzy name matching.
|
||
- Do not treat fuzzy-detected services as managed without verification.
|
||
|
||
## CSP guidance
|
||
|
||
Prefer a restrictive CSP such as:
|
||
|
||
```json
|
||
"security": {
|
||
"csp": "default-src 'self'; img-src 'self' asset: data:; style-src 'self' 'unsafe-inline'; script-src 'self'"
|
||
}
|
||
```
|
||
|
||
Tighten further when possible. If inline styles are removed, remove `'unsafe-inline'`.
|
||
|
||
## Secret redaction
|
||
|
||
For URLs use a parser, not string splitting. Redacted display should include only:
|
||
|
||
- scheme;
|
||
- host;
|
||
- port if useful;
|
||
- generic path marker if necessary.
|
||
|
||
Never show:
|
||
|
||
- username;
|
||
- password;
|
||
- query string;
|
||
- fragment;
|
||
- subscription token path;
|
||
- full proxy credentials.
|
||
|
||
Bad:
|
||
|
||
```text
|
||
https://user:password@example.com/...
|
||
```
|
||
|
||
Good:
|
||
|
||
```text
|
||
https://example.com/...
|
||
```
|
||
|
||
## Subscription fetch hardening
|
||
|
||
- Add connect/read timeout.
|
||
- Accept only `http` and `https` unless explicitly designed otherwise.
|
||
- Consider blocking loopback/private/link-local/multicast/metadata addresses by default.
|
||
- Add explicit allow-local option only if needed.
|
||
- Do not follow redirects into blocked address ranges without re-check.
|
||
- Avoid storing remote body in logs.
|
||
|
||
## Temp/elevated script hardening
|
||
|
||
Runtime-generated elevated scripts must:
|
||
|
||
- use unpredictable names, preferably UUID/random;
|
||
- be written to a safe controlled directory where possible;
|
||
- set restrictive ACL when practical;
|
||
- be generated from static templates with escaped parameters;
|
||
- avoid including secrets in command line args;
|
||
- be cleaned up best-effort;
|
||
- fail closed if path validation fails.
|
||
|
||
Timestamp-only temp names are not enough.
|
||
|
||
## Atomic writes
|
||
|
||
For config files used by services:
|
||
|
||
1. Write to temp file in same directory.
|
||
2. Validate temp file if validator exists.
|
||
3. Backup current file.
|
||
4. Rename temp to final.
|
||
5. On failure, preserve backup and return actionable error.
|
||
|
||
## Safe delete checklist
|
||
|
||
Before recursive delete:
|
||
|
||
- Is path absolute?
|
||
- Is it under expected managed root?
|
||
- Does it contain ProxyWarden marker metadata?
|
||
- Does service PathName point inside this directory?
|
||
- Is it not drive root, user profile root, Desktop, ProgramData root, Windows directory, temp root?
|
||
- Is user action explicit?
|
||
|
||
If answer is unclear, do not delete.
|
||
|
||
## Final report expectations
|
||
|
||
When touching security-sensitive code, report:
|
||
|
||
- what threat was addressed;
|
||
- what was hardened;
|
||
- what remains unverified;
|
||
- whether any secrets could appear in logs/UI;
|
||
- whether Windows elevated path was tested.
|
||
|
||
## Как отчитываться
|
||
|
||
Перед финальным ответом применить `.agent/skills/communication-reporting/SKILL.md` и `.agent/checklists/communication.md`.
|
||
|
||
Минимум для нетривиальной задачи:
|
||
|
||
- короткая сводка;
|
||
- таблица файлов `Файл / Что изменилось / Зачем`;
|
||
- важные места без пересказа каждой строки;
|
||
- что проверено;
|
||
- что не проверено;
|
||
- конкретные риски.
|