Skip to content

v1.0.1 Security Report

Findings and fixes

  • Inline chart injection: Public ChartSpec strings were embedded directly in HTML/SVG and inline JavaScript. v1.0.1 escapes element/attribute content and replaces closing script markers in serialized chart data.
  • Hashing denial of service: A zero or negative chunk_size could cause the file-hash read loop not to advance. v1.0.1 rejects non-positive values.

Verified controls

  • YAML configuration uses safe_load and safe_dump.
  • Session and report paths use resolved-root containment checks.
  • Plugin discovery and lifecycle failures are isolated and support strict mode.
  • Logging includes common secret-assignment redaction.
  • Session JSON is validated through immutable Pydantic domain models on load.

Residual risks

Plugin entry points execute installed Python code by design; treat plugins as trusted local code and keep strict mode available for controlled environments. Chart HTML depends on a CDN-provided Plotly script in the report template; deployments needing offline or supply-chain-controlled reporting should pin or self-host that asset.