Username
6da80aec76
docs: update for simplified MIME detection (v1.5.1)
2025-12-26 19:52:40 +01:00
Username
fb45005766
add polyglot generator and MIME confusion tests
...
- polyglot_generator.py: creates files valid in multiple formats
- 41 new tests verify MIME detection handles polyglots correctly
- Document rate limiting behavior under attack
- Clarify DMG/ISO/DOCX detection limitations
2025-12-26 18:25:46 +01:00
Username
98694ba1cc
docs: add comprehensive threat model
...
STRIDE analysis covering:
- System architecture and trust boundaries
- Attack surface analysis (10 entry points)
- Threat actors (anonymous, authenticated, operator, sophisticated)
- 20+ threats with mitigations across STRIDE categories
- Security controls matrix
- MIME polyglot attack mitigations
- Cryptographic controls
- Residual risks and known limitations
- Incident response guidance
2025-12-26 17:10:41 +01:00
Username
dc2da67fb3
add Hypothesis property-based MIME detection tests
...
- test_magic_prefix_detection: verify all signatures with random suffix
- test_random_binary_never_crashes: random data never crashes
- test_partial_magic_no_false_match: truncated magic handled safely
- test_magic_not_at_start_ignored: only detect magic at offset 0
2025-12-26 17:09:02 +01:00
Username
03bcb157cc
add HEIC/HEIF/AVIF MIME detection signatures
...
- Add ftyp box signatures for heic, mif1, and avif brands
- Add tests for new image formats
- Fix nested if lint warning in lookup rate limit
- Update security docs: MKV uses WebM header, TAR needs offset 257
2025-12-26 17:04:51 +01:00
Username
93a4dd2f97
ci: add security headers audit to pipeline
2025-12-26 16:56:03 +01:00
Username
bd75f81afd
add security testing suite and update docs
...
- tests/security/pentest_session.py: comprehensive 10-phase pentest
- tests/security/profiled_server.py: cProfile-enabled server
- tests/security/cli_security_audit.py: CLI security checks
- tests/security/dos_memory_test.py: memory exhaustion tests
- tests/security/race_condition_test.py: concurrency tests
- docs: add pentest results, profiling analysis, new test commands
2025-12-26 00:39:33 +01:00
Username
c1d2e39b09
docs: complete penetration testing status update
...
All pentest items now complete:
- CLI security audit (clipboard, permissions)
- DoS memory exhaustion (fixed lookup rate limit)
- Race conditions (all protected by locks)
2025-12-26 00:17:11 +01:00
Username
0fa6052f69
docs: update security testing status with completed tests
...
- Add race condition testing results (HEAD triggers burn-after-read)
- Add timing attack analysis (PBKDF2 constant-time verified)
- Mark RPM, AVI, WAV MIME signatures as fixed
- Update security controls table with new verifications
2025-12-25 23:58:42 +01:00
Username
4823ff7b5d
docs: update MIME testing results (26 signatures tested)
2025-12-25 23:37:05 +01:00
Username
645f6feefd
docs: add security testing status and remaining tasks
2025-12-25 23:04:33 +01:00
