[Security / performance] Workspace review and verified hardening — September 2026 #296

New Issue

2026-09-08T00:35:20+02:00

zemion commented

2026-09-08 00:35:20 +02:00

User-requested workspace-wide security and inefficiency review, followed by high-confidence implementation and regression verification. Scope includes shared authentication and browser caching, file/mail/import boundaries, module query amplification, dependency audits, and static scanning. Preserve existing local changes and optional module boundaries. No live campaign/file/mail mutations, deployment changes, commits, or pushes in this pass. Findings and evidence will be recorded here with owning module issues as needed; scanner coverage limitations and unmeasured production effects must be explicit.

zemion referenced this issue from GovOPlaN/govoplan-connectors

2026-09-08 00:59:18 +02:00

[Security] Bound spreadsheet coordinate expansion before XLSX traversal #18

zemion referenced this issue from GovOPlaN/govoplan-access

2026-09-08 00:59:22 +02:00

[Security] Preserve authentication source, service-account ceilings and tenant-only grants #21

zemion referenced this issue from GovOPlaN/govoplan-templates

2026-09-08 00:59:22 +02:00

[Security] Enforce render output budget during construction #7

zemion referenced this issue from GovOPlaN/govoplan-docs

2026-09-08 00:59:36 +02:00

[Performance / security] Batch semantic revision reads and validate projection ownership #22

zemion referenced this issue from GovOPlaN/govoplan-reporting

2026-09-08 00:59:40 +02:00

[Bug] Keep nested calculated-measure bind names valid #10

zemion referenced this issue from GovOPlaN/govoplan-files

2026-09-08 00:59:42 +02:00

[Security] Bound TAR inspection before payload traversal #46

zemion referenced this issue from GovOPlaN/govoplan-notifications

2026-09-08 00:59:44 +02:00

[Performance / security] Batch notification attempts and preserve tenant boundaries #6

zemion commented

2026-09-08 01:05:08 +02:00

Verified implementation progress (local, not pushed):

Access #21: preserve service-account identity/current ceilings and tenant-only API-key permissions; consistent credential-source handling; SQL-bounded session list.
Files #46: incremental TAR and path/directory limits.
Connectors #18: bound actual XLSX coordinate expansion.
Templates #7: enforce render budgets before allocation.
Docs #22: batched revision projection with tenant/publication/owner checks.
Notifications #6: batched attempt loading with tenant/recipient consistency.
Reporting #10: valid structural bind names for nested calculations.
Core: auth/session/mutation-aware response caches honor no-store/no-cache; obsolete401 responses cannot expire a newer session; interactive login/logout clear retained automation keys. Redundant header sorting/key serialization removed without changing cache identity.
Dependency updates: aligned patched Tiptap3.31.3 packages, xmldom0.9.12, browserslist4.28.9, nanoid3.3.18; pip minimum26.2 (local26.2.1). Website's affected build dependencies also patched. Full npm audits now report zero affected entries for Core, both Mail locks and website; pip-audit reports zero known vulnerabilities among137 auditable installed distributions (51 local distributions are not in PyPI and remain source-review scope).

Evidence: 209/209 isolated browser conformance cases passed; production build and unchanged bundle budgets pass; Core cache/dependency24 regressions pass; full Access91, Docs39, Notifications23, Reporting29, Templates20 and Dataflow104 tests pass, plus targeted Files/Connectors checks and39 Dataflow subtests. EN/DE owning documentation updated. Required focused gate still fails at the existing institutional governance/portal fixture (tests/test_institutional_governance_journey.py:223, IndexError); no unrelated behavior change was made to hide it.

Security scan coverage so far: Semgrep272 applicable rules over4,169 tracked targets; seven owner-only0700-permission warnings reviewed as false positives (do not weaken them). Calendar's initial rule timeout was rechecked with a larger per-rule budget and has zero findings/errors. Bash syntax and conformance TypeScript checks cover two scanner parser limitations. Bandit scanned446,679 production Python lines, with no high findings; SQL-construction warnings reviewed against parameter/identifier controls. Gitleaks worktree scan:79 repositories, zero findings,100% redaction. A final reproducible snapshot scan including Git history is running. No live application mutations, scans against the running server, deployment changes, commits or pushes.

The Campaign host-path concern was ruled out by existing tracked API/build/snapshot guards and11 passing tests. No Campaign change was needed. A standalone test-import-order failure remains separate. Findings are not a security certification; hard process resource limits, forced password-change/recovery, large-history pagination and production load verification remain next work.

Verified implementation progress (local, not pushed): - Access #21: preserve service-account identity/current ceilings and tenant-only API-key permissions; consistent credential-source handling; SQL-bounded session list. - Files #46: incremental TAR and path/directory limits. - Connectors #18: bound actual XLSX coordinate expansion. - Templates #7: enforce render budgets before allocation. - Docs #22: batched revision projection with tenant/publication/owner checks. - Notifications #6: batched attempt loading with tenant/recipient consistency. - Reporting #10: valid structural bind names for nested calculations. - Core: auth/session/mutation-aware response caches honor no-store/no-cache; obsolete401 responses cannot expire a newer session; interactive login/logout clear retained automation keys. Redundant header sorting/key serialization removed without changing cache identity. - Dependency updates: aligned patched Tiptap3.31.3 packages, xmldom0.9.12, browserslist4.28.9, nanoid3.3.18; pip minimum26.2 (local26.2.1). Website's affected build dependencies also patched. Full npm audits now report zero affected entries for Core, both Mail locks and website; pip-audit reports zero known vulnerabilities among137 auditable installed distributions (51 local distributions are not in PyPI and remain source-review scope). Evidence: 209/209 isolated browser conformance cases passed; production build and unchanged bundle budgets pass; Core cache/dependency24 regressions pass; full Access91, Docs39, Notifications23, Reporting29, Templates20 and Dataflow104 tests pass, plus targeted Files/Connectors checks and39 Dataflow subtests. EN/DE owning documentation updated. Required focused gate still fails at the existing institutional governance/portal fixture (tests/test_institutional_governance_journey.py:223, IndexError); no unrelated behavior change was made to hide it. Security scan coverage so far: Semgrep272 applicable rules over4,169 tracked targets; seven owner-only0700-permission warnings reviewed as false positives (do not weaken them). Calendar's initial rule timeout was rechecked with a larger per-rule budget and has zero findings/errors. Bash syntax and conformance TypeScript checks cover two scanner parser limitations. Bandit scanned446,679 production Python lines, with no high findings; SQL-construction warnings reviewed against parameter/identifier controls. Gitleaks worktree scan:79 repositories, zero findings,100% redaction. A final reproducible snapshot scan including Git history is running. No live application mutations, scans against the running server, deployment changes, commits or pushes. The Campaign host-path concern was ruled out by existing tracked API/build/snapshot guards and11 passing tests. No Campaign change was needed. A standalone test-import-order failure remains separate. Findings are not a security certification; hard process resource limits, forced password-change/recovery, large-history pagination and production load verification remain next work.

zemion referenced this issue

2026-09-08 01:06:01 +02:00

[Security follow-up] Isolate untrusted parsing and reference execution with hard resource limits #297

zemion referenced this issue from GovOPlaN/govoplan-dataflow

2026-09-08 01:06:03 +02:00

[Security] Bound padding allocations using the existing preview budget #22

zemion referenced this issue from GovOPlaN/govoplan-access

2026-09-08 01:06:25 +02:00

[Security follow-up] Implement forced password change with a complete recovery flow #22

zemion referenced this issue from GovOPlaN/govoplan-xrechnung

2026-09-08 01:06:33 +02:00

[Security] Bound validator output while the subprocess runs #2

zemion referenced this issue from GovOPlaN/govoplan-workflow-engine

2026-09-08 01:06:34 +02:00

[Performance] Batch workflow instance revision evidence and bound history projections #3

zemion referenced this issue from GovOPlaN/govoplan

2026-09-08 01:07:01 +02:00

[Verification] Stabilize the institutional governance journey date fixture #50

zemion commented

2026-09-08 01:10:36 +02:00

Implementation and verification complete for this local pass. Nothing committed, pushed, deployed, or closed.

Final snapshot audit: 79 repositories; unchanged workspace between fingerprint capture; 4/4 required quick-mode scanners available; zero execution errors/missing reports; 168 report artifacts and 163 validated JSON/SARIF reports. Gitleaks scanned all 79 histories and all 79 worktrees with 100% redaction: all 158 reports contain zero findings. Final production Bandit covers 447,008 lines with 63 low/4 medium warnings; Ruff has 54 warnings; local Semgrep rules have no findings. This was report-only, not a falsely claimed warning-free strict audit. Broader OWASP Semgrep review and warning triage are documented; Calendar timeout recheck has no errors/findings. Full container/Trivy/OSV coverage remains outstanding because the Docker daemon was inaccessible.

Final verification: 209/209 browser cases; Core and website production builds; unchanged bundle budgets; conformance TypeScript; 24 Core cache/dependency regressions; 13 audit-wrapper tests; 4 Files real-client reload checks; 72/72 manifests. Backend module evidence is recorded on the linked issues. The unrelated existing focused-gate failure remains tracked in GovOPlaN/govoplan#50.

Additional completed local slice: GovOPlaN/govoplan-dataflow#22 bounds LPAD/RPAD allocation using the existing 1,000,000-byte preview budget. Full 104 tests and 39 subtests pass; 7 guard regressions independently passed. Intermediate oversized values now fail early even when hidden inside a small final expression; owning EN/DE docs explain that change. Website dependency maintenance is recorded in add-ideas/addideas-govoplan-website#8.

Prioritized remaining work:

Core #297: hard process CPU/memory/output isolation and production-like load checks.
GovOPlaN/govoplan-access#22: complete forced password-change/recovery workflow; existing flag remains advisory.
GovOPlaN/govoplan-xrechnung#2: bounded subprocess output while running.
GovOPlaN/govoplan-workflow-engine#3: batched revision evidence and explicit history projections.
Meta #50: repair the clock-sensitive governance verification fixture without changing production visibility semantics.

Durable local review: govoplan/docs/security/SECURITY_PERFORMANCE_REVIEW_2026-09-08.md. Raw evidence and reproducible snapshot manifest: /mnt/DATA/tmp/govoplan-security-performance-20260908-gsk8jn/final-quick/. This is a substantial hardening pass with measured query reductions, not a security certification or a production-throughput claim.

Implementation and verification complete for this local pass. Nothing committed, pushed, deployed, or closed. Final snapshot audit: 79 repositories; unchanged workspace between fingerprint capture; 4/4 required quick-mode scanners available; zero execution errors/missing reports; 168 report artifacts and 163 validated JSON/SARIF reports. Gitleaks scanned all 79 histories and all 79 worktrees with 100% redaction: all 158 reports contain zero findings. Final production Bandit covers 447,008 lines with 63 low/4 medium warnings; Ruff has 54 warnings; local Semgrep rules have no findings. This was report-only, not a falsely claimed warning-free strict audit. Broader OWASP Semgrep review and warning triage are documented; Calendar timeout recheck has no errors/findings. Full container/Trivy/OSV coverage remains outstanding because the Docker daemon was inaccessible. Final verification: 209/209 browser cases; Core and website production builds; unchanged bundle budgets; conformance TypeScript; 24 Core cache/dependency regressions; 13 audit-wrapper tests; 4 Files real-client reload checks; 72/72 manifests. Backend module evidence is recorded on the linked issues. The unrelated existing focused-gate failure remains tracked in GovOPlaN/govoplan#50. Additional completed local slice: GovOPlaN/govoplan-dataflow#22 bounds LPAD/RPAD allocation using the existing 1,000,000-byte preview budget. Full 104 tests and 39 subtests pass; 7 guard regressions independently passed. Intermediate oversized values now fail early even when hidden inside a small final expression; owning EN/DE docs explain that change. Website dependency maintenance is recorded in add-ideas/addideas-govoplan-website#8. Prioritized remaining work: - Core #297: hard process CPU/memory/output isolation and production-like load checks. - GovOPlaN/govoplan-access#22: complete forced password-change/recovery workflow; existing flag remains advisory. - GovOPlaN/govoplan-xrechnung#2: bounded subprocess output while running. - GovOPlaN/govoplan-workflow-engine#3: batched revision evidence and explicit history projections. - Meta #50: repair the clock-sensitive governance verification fixture without changing production visibility semantics. Durable local review: govoplan/docs/security/SECURITY_PERFORMANCE_REVIEW_2026-09-08.md. Raw evidence and reproducible snapshot manifest: /mnt/DATA/tmp/govoplan-security-performance-20260908-gsk8jn/final-quick/. This is a substantial hardening pass with measured query reductions, not a security certification or a production-throughput claim.

zemion commented

2026-09-08 05:02:10 +02:00

Completed the bounded September security/performance review and high-confidence hardening in Core/Meta0.1.45 and coordinated module releases. Findings, measured query counts, scanner coverage, compatibility changes and limitations are recorded in the dated review. Final release verification includes the complete unmodified focused gate,63 production combinations,213 browser cases, and221 release-tool tests plus59 subtests. Two pre-existing PostgreSQL concurrency tests were skipped; no corresponding deployment/concurrency evidence is claimed. An earlier ad-hoc mixed-repository test collection exposed fixture/ORM isolation interference; owning isolated suites passed, and that mixed command is not represented as a successful run.

This is not a penetration test, exhaustive line review, security certification or claim that all debt is resolved. Core#297 (hard resource isolation), Access#22 (usable password-change/recovery), Xrechnung#2 (bounded subprocess output), Workflow Engine#3 (history batching), and Meta#52–#55 remain open, including runtime remediation/coverage, package license completeness and release-tool follow-ups.

Publication evidence: Meta #51 records verified source tags, native packages and signed catalog Git publication. catalog-v0.1.45 is commit 03ac237949a1963189d1b7a4b3cc3397e60b10a1, annotated tag object 3d4735ea3028edfa47341e4f0b53650a4ae868d6, sequence 202609080236; exact stable.json SHA-256 00dd1fa8390b7823dc082eddaca0bd826f9fcee0c479f56cd82ea55f93bf3cc8.

This is not a live website deployment: a fresh public read still serves0.1.18/sequence202608061915. Website #9 owns authorized website rollout and its separate image-review gates. No application runtime distribution was published; Meta #52 remains held. No real mail/file/workflow operations or deployment were used to verify this closure.

Completed the bounded September security/performance review and high-confidence hardening in Core/Meta0.1.45 and coordinated module releases. Findings, measured query counts, scanner coverage, compatibility changes and limitations are recorded in [the dated review](https://git.add-ideas.de/GovOPlaN/govoplan/src/tag/v0.1.45/docs/security/SECURITY_PERFORMANCE_REVIEW_2026-09-08.md). Final release verification includes the complete unmodified focused gate,63 production combinations,213 browser cases, and221 release-tool tests plus59 subtests. Two pre-existing PostgreSQL concurrency tests were skipped; no corresponding deployment/concurrency evidence is claimed. An earlier ad-hoc mixed-repository test collection exposed fixture/ORM isolation interference; owning isolated suites passed, and that mixed command is not represented as a successful run. This is not a penetration test, exhaustive line review, security certification or claim that all debt is resolved. Core#297 (hard resource isolation), Access#22 (usable password-change/recovery), Xrechnung#2 (bounded subprocess output), Workflow Engine#3 (history batching), and Meta#52–#55 remain open, including runtime remediation/coverage, package license completeness and release-tool follow-ups. Publication evidence: [Meta #51](https://git.add-ideas.de/GovOPlaN/govoplan/issues/51) records verified source tags, native packages and signed catalog Git publication. [catalog-v0.1.45](https://git.add-ideas.de/add-ideas/addideas-govoplan-website/src/tag/catalog-v0.1.45/public/catalogs/v1/channels/stable.json) is commit `03ac237949a1963189d1b7a4b3cc3397e60b10a1`, annotated tag object `3d4735ea3028edfa47341e4f0b53650a4ae868d6`, sequence `202609080236`; exact stable.json SHA-256 `00dd1fa8390b7823dc082eddaca0bd826f9fcee0c479f56cd82ea55f93bf3cc8`. This is not a live website deployment: a fresh public read still serves0.1.18/sequence202608061915. [Website #9](https://git.add-ideas.de/add-ideas/addideas-govoplan-website/issues/9) owns authorized website rollout and its separate image-review gates. No application runtime distribution was published; [Meta #52](https://git.add-ideas.de/GovOPlaN/govoplan/issues/52) remains held. No real mail/file/workflow operations or deployment were used to verify this closure.

zemion closed this issue

2026-09-08 05:02:21 +02:00

zemion commented

2026-09-08 08:09:37 +02:00

Completed a further security/performance source wave after the original closed review. All nine commits were pushed and remote main/tag inventories read back:

The final frozen quick audit covered 79 repositories: all four scanners completed, 168 report checksums and 163 machine-readable reports verified. Semgrep/Gitleaks reported zero findings. Production Bandit remains 65 low/four medium and Ruff 54; retained warnings and explicit scan exclusions are documented. The ten-file Meta tooling supplement was reviewed separately. Fresh npm and installed-Python advisory audits found no known vulnerabilities in their covered dependencies, with local package/image exclusions retained.

The full focused run passed 63 build combinations and 230 browser cases. Final release tools passed 279 tests plus 68 subtests. Real PostgreSQL verification passed full Access 122 tests plus 18 subtests, Datasources 57 tests, and four release/development migration cases; fixtures were stopped and removed.

Meta #55 and Workflow Engine #3 are closed at source completion. Core #297, Access #22, Meta #52 and website #9 retain their specific runtime/adoption/deployment gates. Original 0.1.45/catalog-v0.1.45 remain immutable; no new release or deployment is claimed. This parent stays closed; detailed remaining work is tracked in those open issues.

Full implementation, verification and remaining adoption gates. Source main was pushed and read back at its exact commit; existing remote tag inventories were verified unchanged. This is source publication, not a new package/image release or deployment.

Completed a further security/performance source wave after the original closed review. All nine commits were pushed and remote main/tag inventories read back: - [govoplan-core dc1f244f1745](https://git.add-ideas.de/GovOPlaN/govoplan-core/commit/dc1f244f1745d424844ec3c86a6fb1948817b1c5) - [govoplan-access 7eb67b9fa73b](https://git.add-ideas.de/GovOPlaN/govoplan-access/commit/7eb67b9fa73b70c6c3d74a26020377f996b5970b) - [govoplan-connectors be16f8218ec5](https://git.add-ideas.de/GovOPlaN/govoplan-connectors/commit/be16f8218ec507271ed3b076149c400d1882ab84) - [govoplan-dataflow 4175262b8b8f](https://git.add-ideas.de/GovOPlaN/govoplan-dataflow/commit/4175262b8b8f5ec8c581ecb44132bb913b865c75) - [govoplan-files 13433514b9ac](https://git.add-ideas.de/GovOPlaN/govoplan-files/commit/13433514b9ac87e9bf8086802ab5254c66435f98) - [govoplan-templates 1b1e3e0f9265](https://git.add-ideas.de/GovOPlaN/govoplan-templates/commit/1b1e3e0f9265ef5cdddd99069a00935ba70fbdeb) - [govoplan-workflow-engine a2fc5639db04](https://git.add-ideas.de/GovOPlaN/govoplan-workflow-engine/commit/a2fc5639db04ac4452a73e3b445239d3dd92f538) - [govoplan 58d320d9b34a](https://git.add-ideas.de/GovOPlaN/govoplan/commit/58d320d9b34a618aab6ce0b9e48daf943961af66) - [addideas-govoplan-website ef0f8321fd2d](https://git.add-ideas.de/add-ideas/addideas-govoplan-website/commit/ef0f8321fd2d7a86b0bf88434dbec975f16b51c0) The final frozen quick audit covered 79 repositories: all four scanners completed, 168 report checksums and 163 machine-readable reports verified. Semgrep/Gitleaks reported zero findings. Production Bandit remains 65 low/four medium and Ruff 54; retained warnings and explicit scan exclusions are documented. The ten-file Meta tooling supplement was reviewed separately. Fresh npm and installed-Python advisory audits found no known vulnerabilities in their covered dependencies, with local package/image exclusions retained. The full focused run passed 63 build combinations and 230 browser cases. Final release tools passed 279 tests plus 68 subtests. Real PostgreSQL verification passed full Access 122 tests plus 18 subtests, Datasources 57 tests, and four release/development migration cases; fixtures were stopped and removed. Meta #55 and Workflow Engine #3 are closed at source completion. Core #297, Access #22, Meta #52 and website #9 retain their specific runtime/adoption/deployment gates. Original 0.1.45/catalog-v0.1.45 remain immutable; no new release or deployment is claimed. This parent stays closed; detailed remaining work is tracked in those open issues. [Full implementation, verification and remaining adoption gates](https://git.add-ideas.de/GovOPlaN/govoplan/src/commit/58d320d9b34a618aab6ce0b9e48daf943961af66/docs/security/SECURITY_FOLLOWUP_2026-09-08.md). Source main was pushed and read back at its exact commit; existing remote tag inventories were verified unchanged. This is source publication, not a new package/image release or deployment.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-core#296