mirror of
https://github.com/jhd3197/ServerKit.git
synced 2026-10-23 03:27:43 +09:00
Juan Denis
b992220f79
Add cross-platform development launchers (dev.sh, dev.ps1) and a frontend ESLint flat config; remove legacy scripts and update docs to use ./dev.sh. Harden backup and storage logic: require admin for backup endpoints, use realpath checks to ensure backup paths stay inside the backup dir, prevent path traversal during archive extraction, and generate schedule IDs with UUIDs. Improve StorageProviderService with masked-secret handling, set restrictive file perms on config, validate S3/B2 endpoint URLs to mitigate SSRF (urlparse + ipaddress), avoid following symlinks during uploads, and adjust MD5 usage. Update Bandit config to skip expected noisy checks and tweak .gitignore entries and contributing docs to target the dev branch and the new dev scripts.
20 lines
1.2 KiB
Plaintext
20 lines
1.2 KiB
Plaintext
[bandit]
|
|
# Exclude test files from scanning
|
|
exclude_dirs = tests,venv,.venv
|
|
|
|
# Skip checks that are expected noise for a server management tool:
|
|
# B108: hardcoded_tmp_directory — intentional temp dirs for sync operations
|
|
# B110: try_except_pass — cleanup/daemon patterns throughout codebase
|
|
# B310: urllib_urlopen — internal diagnostic and update-check calls
|
|
# B321: ftplib — FTP service exists by design
|
|
# B402: import_ftplib — same as above
|
|
# B404: import_subprocess — we intentionally use subprocess throughout
|
|
# B602: subprocess_popen_with_shell_equals_true — build/cron/deploy hooks require shell
|
|
# B603: subprocess_without_shell_check — we use subprocess.run deliberately
|
|
# B607: start_process_with_partial_path — expected for system commands
|
|
# B608: hardcoded_sql_expressions — admin-only DB service with internal calls, not user input
|
|
# B105: hardcoded_password_string — false positives on empty-string defaults and mask values
|
|
# B112: try_except_continue — same pattern as B110, used in iteration/cleanup loops
|
|
# B311: random — used for non-security port selection, not crypto
|
|
skips = B105,B108,B110,B112,B310,B311,B321,B402,B404,B602,B603,B607,B608
|