From 18e89136b1ab618948144dcceff12ad34230e767 Mon Sep 17 00:00:00 2001 From: kev1n77 Date: Tue, 21 Jul 2026 17:37:01 +0800 Subject: [PATCH] build: patch vulnerable dependencies --- Cargo.lock | 16 ++--- Cargo.toml | 2 +- apps/desktop/package.json | 2 +- apps/desktop/src-tauri/Cargo.lock | 100 ++++++++++++------------------ apps/desktop/src-tauri/Cargo.toml | 2 +- docs/progress.html | 5 +- docs/threat-model.html | 2 +- package-lock.json | 8 +-- 8 files changed, 58 insertions(+), 79 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 3333587..0232383 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1061,9 +1061,9 @@ dependencies = [ [[package]] name = "num-conv" -version = "0.1.0" +version = "0.2.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9" +checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441" [[package]] name = "num-integer" @@ -1732,9 +1732,9 @@ dependencies = [ [[package]] name = "time" -version = "0.3.45" +version = "0.3.47" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f9e442fc33d7fdb45aa9bfeb312c095964abdf596f7567261062b2a7107aaabd" +checksum = "743bd48c283afc0388f9b8827b976905fb217ad9e647fae3a379a9283c4def2c" dependencies = [ "deranged", "itoa", @@ -1747,15 +1747,15 @@ dependencies = [ [[package]] name = "time-core" -version = "0.1.7" +version = "0.1.8" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8b36ee98fd31ec7426d599183e8fe26932a8dc1fb76ddb6214d05493377d34ca" +checksum = "7694e1cfe791f8d31026952abf09c69ca6f6fa4e1a1229e18988f06a04a12dca" [[package]] name = "time-macros" -version = "0.2.25" +version = "0.2.27" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "71e552d1249bf61ac2a52db88179fd0673def1e1ad8243a00d9ec9ed71fee3dd" +checksum = "2e70e4c5a0e0a8a4823ad65dfe1a6930e4f4d756dcd9dd7939022b5e8c501215" dependencies = [ "num-conv", "time-core", diff --git a/Cargo.toml b/Cargo.toml index be78803..57f353e 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -5,7 +5,7 @@ resolver = "3" [workspace.package] edition = "2024" -rust-version = "1.85" +rust-version = "1.88" [workspace.dependencies] axum = "0.8" diff --git a/apps/desktop/package.json b/apps/desktop/package.json index 4da4f10..77b3227 100644 --- a/apps/desktop/package.json +++ b/apps/desktop/package.json @@ -16,7 +16,7 @@ "@tanstack/react-virtual": "3.13.12", "@tauri-apps/api": "2.11.1", "@tauri-apps/plugin-dialog": "2.7.1", - "diff": "8.0.2", + "diff": "8.0.3", "lucide-react": "1.24.0", "react": "19.2.7", "react-dom": "19.2.7" diff --git a/apps/desktop/src-tauri/Cargo.lock b/apps/desktop/src-tauri/Cargo.lock index 3915888..3f5b967 100644 --- a/apps/desktop/src-tauri/Cargo.lock +++ b/apps/desktop/src-tauri/Cargo.lock @@ -311,6 +311,15 @@ dependencies = [ "alloc-stdlib", ] +[[package]] +name = "bs58" +version = "0.5.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bf88ba1141d185c399bee5288d850d63b8369520c1eafc32a0430b5b6c287bf4" +dependencies = [ + "tinyvec", +] + [[package]] name = "bumpalo" version = "3.20.3" @@ -814,9 +823,9 @@ checksum = "52560adf09603e58c9a7ee1fe1dcb95a16927b17c127f0ac02d6e768a0e25bc1" [[package]] name = "darling" -version = "0.21.3" +version = "0.23.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9cdf337090841a411e2a7f3deb9187445851f91b309c0c0a29e05f74a00a48c0" +checksum = "25ae13da2f202d56bd7f91c25fba009e7717a1e4a1cc98a76d844b65ae912e9d" dependencies = [ "darling_core", "darling_macro", @@ -824,11 +833,10 @@ dependencies = [ [[package]] name = "darling_core" -version = "0.21.3" +version = "0.23.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1247195ecd7e3c85f83c8d2a366e4210d588e802133e1e355180a9870b517ea4" +checksum = "9865a50f7c335f53564bb694ef660825eb8610e0a53d3e11bf1b0d3df31e03b0" dependencies = [ - "fnv", "ident_case", "proc-macro2", "quote", @@ -838,9 +846,9 @@ dependencies = [ [[package]] name = "darling_macro" -version = "0.21.3" +version = "0.23.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d38308df82d1080de0afee5d069fa14b0326a88c14f15c5ccda35b4a6c414c81" +checksum = "ac3984ec7bd6cfa798e62b4a642426a5be0e68f9401cfc2a01e3fa9ea2fcdb8d" dependencies = [ "darling_core", "quote", @@ -1775,7 +1783,7 @@ dependencies = [ "js-sys", "log", "wasm-bindgen", - "windows-core 0.62.2", + "windows-core", ] [[package]] @@ -2357,9 +2365,9 @@ dependencies = [ [[package]] name = "num-conv" -version = "0.1.0" +version = "0.2.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9" +checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441" [[package]] name = "num-integer" @@ -3628,11 +3636,12 @@ dependencies = [ [[package]] name = "serde_with" -version = "3.17.0" +version = "3.21.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "381b283ce7bc6b476d903296fb59d0d36633652b633b27f64db4fb46dcbfc3b9" +checksum = "76a5c54c7310e7b8b9577c286d7e399ddd876c3e12b3ed917a8aabc4b96e9e8c" dependencies = [ "base64 0.22.1", + "bs58", "chrono", "hex", "indexmap 1.9.3", @@ -3647,9 +3656,9 @@ dependencies = [ [[package]] name = "serde_with_macros" -version = "3.17.0" +version = "3.21.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a6d4e30573c8cb306ed6ab1dca8423eec9a463ea0e155f45399455e0368b27e0" +checksum = "84d57bc0c8b9a17920c178daa6bb924850d54a9c97ab45194bb8c17ad66bb660" dependencies = [ "darling", "proc-macro2", @@ -3955,7 +3964,7 @@ dependencies = [ "unicode-segmentation", "url", "windows", - "windows-core 0.61.2", + "windows-core", "windows-version", "x11-dl", ] @@ -4365,9 +4374,9 @@ dependencies = [ [[package]] name = "time" -version = "0.3.45" +version = "0.3.47" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f9e442fc33d7fdb45aa9bfeb312c095964abdf596f7567261062b2a7107aaabd" +checksum = "743bd48c283afc0388f9b8827b976905fb217ad9e647fae3a379a9283c4def2c" dependencies = [ "deranged", "itoa", @@ -4380,15 +4389,15 @@ dependencies = [ [[package]] name = "time-core" -version = "0.1.7" +version = "0.1.8" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8b36ee98fd31ec7426d599183e8fe26932a8dc1fb76ddb6214d05493377d34ca" +checksum = "7694e1cfe791f8d31026952abf09c69ca6f6fa4e1a1229e18988f06a04a12dca" [[package]] name = "time-macros" -version = "0.2.25" +version = "0.2.27" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "71e552d1249bf61ac2a52db88179fd0673def1e1ad8243a00d9ec9ed71fee3dd" +checksum = "2e70e4c5a0e0a8a4823ad65dfe1a6930e4f4d756dcd9dd7939022b5e8c501215" dependencies = [ "num-conv", "time-core", @@ -5087,7 +5096,7 @@ dependencies = [ "webview2-com-macros", "webview2-com-sys", "windows", - "windows-core 0.61.2", + "windows-core", "windows-implement", "windows-interface", ] @@ -5111,7 +5120,7 @@ checksum = "381336cfffd772377d291702245447a5251a2ffa5bad679c99e61bc48bacbf9c" dependencies = [ "thiserror 2.0.18", "windows", - "windows-core 0.61.2", + "windows-core", ] [[package]] @@ -5167,7 +5176,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "9babd3a767a4c1aef6900409f85f5d53ce2544ccdfaa86dad48c91782c6d6893" dependencies = [ "windows-collections", - "windows-core 0.61.2", + "windows-core", "windows-future", "windows-link 0.1.3", "windows-numerics", @@ -5179,7 +5188,7 @@ version = "0.2.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "3beeceb5e5cfd9eb1d76b381630e82c4241ccd0d27f1a39ed41b2760b255c5e8" dependencies = [ - "windows-core 0.61.2", + "windows-core", ] [[package]] @@ -5191,21 +5200,8 @@ dependencies = [ "windows-implement", "windows-interface", "windows-link 0.1.3", - "windows-result 0.3.4", - "windows-strings 0.4.2", -] - -[[package]] -name = "windows-core" -version = "0.62.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb" -dependencies = [ - "windows-implement", - "windows-interface", - "windows-link 0.2.1", - "windows-result 0.4.1", - "windows-strings 0.5.1", + "windows-result", + "windows-strings", ] [[package]] @@ -5214,7 +5210,7 @@ version = "0.2.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "fc6a41e98427b19fe4b73c550f060b59fa592d7d686537eebf9385621bfbad8e" dependencies = [ - "windows-core 0.61.2", + "windows-core", "windows-link 0.1.3", "windows-threading", ] @@ -5259,7 +5255,7 @@ version = "0.2.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "9150af68066c4c5c07ddc0ce30421554771e528bde427614c61038bc2c92c2b1" dependencies = [ - "windows-core 0.61.2", + "windows-core", "windows-link 0.1.3", ] @@ -5272,15 +5268,6 @@ dependencies = [ "windows-link 0.1.3", ] -[[package]] -name = "windows-result" -version = "0.4.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5" -dependencies = [ - "windows-link 0.2.1", -] - [[package]] name = "windows-strings" version = "0.4.2" @@ -5290,15 +5277,6 @@ dependencies = [ "windows-link 0.1.3", ] -[[package]] -name = "windows-strings" -version = "0.5.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091" -dependencies = [ - "windows-link 0.2.1", -] - [[package]] name = "windows-sys" version = "0.45.0" @@ -5643,7 +5621,7 @@ dependencies = [ "webkit2gtk-sys", "webview2-com", "windows", - "windows-core 0.61.2", + "windows-core", "windows-version", "x11-dl", ] diff --git a/apps/desktop/src-tauri/Cargo.toml b/apps/desktop/src-tauri/Cargo.toml index 681e774..8125209 100644 --- a/apps/desktop/src-tauri/Cargo.toml +++ b/apps/desktop/src-tauri/Cargo.toml @@ -4,7 +4,7 @@ version = "0.1.0" description = "CodeIsCheap local AI request inspector" authors = ["CodeIsCheap contributors"] edition = "2024" -rust-version = "1.85" +rust-version = "1.88" [lib] name = "codeischeap_desktop_lib" diff --git a/docs/progress.html b/docs/progress.html index 424db42..8b494a7 100644 --- a/docs/progress.html +++ b/docs/progress.html @@ -61,7 +61,7 @@

4. 工作流进度

Desktop / FrontendAPP-001~00696%In progressCodex / TBD完成屏幕阅读器、首次捕获耗时与真实运行验收 Capture / NetworkCAP-001~00788%In progressCodex / TBD完成 macOS helper 真实故障矩阵；生产签名随发布凭据补齐 Prompt / AdaptersPAR-001~007100%DoneCodex / TBD保持价格目录与 provider usage 映射可追溯 - Data / SecurityDAT-001~002、SEC-001~00494%In progressCodex / TBD继续 WASI 权限、正式签名制品与独立安全评审 + Data / SecurityDAT-001~002、SEC-001~00495%In progressCodex / TBD继续 WASI 权限、正式签名制品与独立安全评审 Test / ReleaseTST-001~004、REL-001~00372%In progressCodex / TBD继续更新回滚演练、屏幕阅读器与支持处理流程 @@ -90,7 +90,7 @@

5. 当前迭代：S5 / S6

SEC-001范围策略和凭据 scrubberDone100%Codex / Security Reviewer TBD2026-07-18请求与响应 header/JSON body 双层脱敏；canary 在 DB、WAL、诊断日志、临时文件和支持包中零命中 SEC-002脱敏与导出Done100%Codex / Security Reviewer TBD2026-07-18单请求、筛选批量及支持包均强制扫描、完整预览、SHA-256 防陈旧和只新建文件；版本化 corpus 以 36 个字段名、17 类文本 secret 及近似反例覆盖 Rust/Python/Web SEC-003本地 IPC 与插件隔离In progress97%Codex / Security Reviewer TBD2026-08-25IPC 0.6 在 Windows 使用当前用户与 SYSTEM protected DACL、拒绝远端连接的随机 named pipe，创建后回读 owner/ACE 并逐连接核对 sidecar PID；macOS/Linux 使用当前 eUID `0700` 私有目录内 `0600` Unix socket，并逐连接核对 peer eUID/PID；统一使用 256-bit token、常量时间比较、1 KiB 认证帧、2 秒截止和 ACK，真实传输、超时恢复与旧 0.5 bundle 拒绝均有测试；仅插件启用后的 WASI 最小权限待完成 - SEC-004更新与供应链In progress88%Codex / Release Owner TBD2026-08-25CI Action 固定完整 commit SHA；PR 执行高危依赖审查；Dependabot 与仓库策略覆盖依赖和所有权。Tauri updater 仅接受编译时可信公钥与 HTTPS GitHub Release metadata，安装前重新核对版本、恢复系统代理并建立 SQLCipher 恢复快照；正式公钥、平台签名和发布制品待完成 + SEC-004更新与供应链In progress92%Codex / Release Owner TBD2026-08-25CI Action 固定完整 commit SHA；PR 执行高危依赖审查；Dependabot 与仓库策略覆盖依赖和所有权；diff、time 与 serde_with 已升级到首个安全版本，Rust MSRV 同步至 1.88。Tauri updater 仅接受编译时可信公钥与 HTTPS GitHub Release metadata，安装前重新核对版本、恢复系统代理并建立 SQLCipher 恢复快照；正式公钥、平台签名和发布制品待完成 PAR-001Prompt IR v0.1 与首批 fixturesDone100%Codex / TBD2026-07-14OpenAI/Anthropic fixtures、校验与 schema 完成 PAR-002解析器注册表与检测链Done100%Codex / TBD2026-07-15置信度排序、错误/panic 隔离、IR 校验、partial issues 与 Raw fallback 完成 PAR-003OpenAI-compatible 适配器Done100%Codex / TBD2026-07-15Responses、Chat、Completions、多模态与 tools golden fixtures 通过 @@ -235,6 +235,7 @@

11. 决策与变更记录

2026-07-21Security / IPCSEC-003 Windows named pipe DACL 激活IPC 升级至 0.6；Windows 桌面使用 96-bit 随机名、拒绝远端客户端的 named pipe，protected DACL 仅含当前用户与 SYSTEM，创建后从内核回读 owner、ACE、继承标记和权限；每条连接核对 sidecar PID，每个连接独占 instance 且提前创建下一实例，超时不复用 overlapped handle；Rust、Tauri 与 Python raw Win32 pipe 测试覆盖 DACL、PID、帧、ACK、拒绝与恢复，旧 0.5 bundle 启动前拒绝Codex 2026-07-21Security / Supply chainARC-001 完成，SEC-004 仓库门禁落地CODEOWNERS 覆盖安全边界；CI Action 固定完整 SHA，并通过依赖审查拒绝新增高危漏洞；Dependabot 覆盖四类依赖生态；确定性脚本与单测校验 npm、pip、Cargo、锁文件和仓库策略Codex 2026-07-21Release / UpdaterREL-001 / SEC-004 签名更新入口完成首段Tauri updater 使用编译时可信公钥和固定 HTTPS GitHub Release endpoint；安装前重新检查版本、恢复系统代理、切回 Gateway，并建立可验证恢复的 SQLCipher 备份和版本化 journal；设置页显示可用版本、说明和下载进度，未配置公钥时失败关闭Codex + 2026-07-21Security / DependenciesSEC-004 兼容漏洞修复npm diff 升至 8.0.3，两份 Cargo lock 的 time 升至 0.3.47，桌面 serde_with 升至 3.21.0，并将声明 MSRV 提升到依赖要求的 Rust 1.88；glib 告警来自最新版 Tauri 的 Linux GTK3 链，仓库及 Tauri/Wry 未调用受影响 VariantStrIter，单独按 not-used 证据处置Codex 后续范围、架构、日期或资源变化均在此追加，并链接对应 ADR/会议结论。 diff --git a/docs/threat-model.html b/docs/threat-model.html index f82d3a3..d320321 100644 --- a/docs/threat-model.html +++ b/docs/threat-model.html @@ -49,7 +49,7 @@

威胁台账

TM-04数据库文件被离线读取SQLCipher、WAL、迁移、加密备份、错误密钥、DB/WAL canary 与跨平台 OS 凭据库 CI锁定状态与 key 丢失恢复体验 TM-05本地 CA 私钥泄露或残留信任每设备 CA、跨平台私钥权限检查、指纹 UI、Windows CurrentUser 与 macOS User 幂等卸载已实现；macOS 信任拒绝会清理本次新增证书，桌面保持未信任并允许重试两平台交互式验收；发布前独立安全评审 TM-06崩溃后系统代理残留Windows/macOS 强杀恢复实验；Windows 桌面已接入私有 journal、watchdog、启动恢复和活 owner 校验；sidecar 单独退出会按代际恢复代理并回退 Gateway；端口占用者无法通过独立 256-bit readiness token 校验，冲突启动会清理进程树且不会切换系统代理；PAC 双重失败由 watchdog 恢复；macOS 使用静态逐参数 quote 的授权命令启动受校验可执行文件，helper 控制 socket 分别校验用户 owner 与 root peer，owner 断连、helper 崩溃和下次启动均进入独立恢复链macOS 授权桌面 helper 的真实管理员交互与强杀故障矩阵 - TM-07依赖、sidecar 或更新包被替换CI Action 固定完整 SHA；直接依赖、锁文件、artifact integrity、CODEOWNERS 与 Dependabot 覆盖由策略脚本校验；PR 拒绝新增高危漏洞；sidecar manifest、SBOM 与启动前 hash 校验已接入。Tauri updater 仅接受编译时可信公钥签名的 HTTPS release，安装前重新核对版本、恢复代理并生成加密数据库恢复快照正式公钥托管、平台签名、迁移失败回滚和发布演练；发布硬门槛 + TM-07依赖、sidecar 或更新包被替换CI Action 固定完整 SHA；直接依赖、锁文件、artifact integrity、CODEOWNERS 与 Dependabot 覆盖由策略脚本校验；PR 拒绝新增高危漏洞，diff、time 与 serde_with 已升级到安全版本；sidecar manifest、SBOM 与启动前 hash 校验已接入。Tauri updater 仅接受编译时可信公钥签名的 HTTPS release，安装前重新核对版本、恢复代理并生成加密数据库恢复快照正式公钥托管、平台签名、迁移失败回滚和发布演练；持续跟踪 Tauri Linux GTK3 链的 glib 上游修复；发布硬门槛 TM-08复制或导出泄露秘密单请求、最多 200 条批量导出及支持包均强制扫描与完整预览；版本化 corpus 覆盖 36 个敏感字段名、17 类文本 secret 及近似反例，Rust/Python/Web 一致性回归通过；稳定占位符、策略版本、SHA-256 防陈旧和只新建文件已实现独立安全评审与 corpus 持续维护 TM-09恶意 Prompt 触发 UI 注入React 默认转义、Tauri CSPRaw 仅纯文本、URL 不自动执行、XSS fixture TM-10超大/高速流量耗尽内存或磁盘认证帧 1 KiB、Envelope 4 MiB、sidecar 有界队列、IPC 连接截止时间、存储配额与磁盘压力暂停完善丢弃/降级指标与高压故障注入 diff --git a/package-lock.json b/package-lock.json index e85abc2..85939b9 100644 --- a/package-lock.json +++ b/package-lock.json @@ -16,7 +16,7 @@ "@tanstack/react-virtual": "3.13.12", "@tauri-apps/api": "2.11.1", "@tauri-apps/plugin-dialog": "2.7.1", - "diff": "8.0.2", + "diff": "8.0.3", "lucide-react": "1.24.0", "react": "19.2.7", "react-dom": "19.2.7" @@ -2642,9 +2642,9 @@ } }, "node_modules/diff": { - "version": "8.0.2", - "resolved": "https://registry.npmmirror.com/diff/-/diff-8.0.2.tgz", - "integrity": "sha512-sSuxWU5j5SR9QQji/o2qMvqRNYRDOcBTgsJ/DeCf4iSN4gW+gNMXM7wFIP+fdXZxoNiAnHUTGjCr+TSWXdRDKg==", + "version": "8.0.3", + "resolved": "https://registry.npmmirror.com/diff/-/diff-8.0.3.tgz", + "integrity": "sha512-qejHi7bcSD4hQAZE0tNAawRK1ZtafHDmMTMkrrIGgSLl7hTnQHmKCeB45xAcbfTqK2zowkM3j3bHt/4b/ARbYQ==", "license": "BSD-3-Clause", "engines": { "node": ">=0.3.1"