9f893c3858
VSIX fetch + extract for URL targets now runs in a sub-process wrapped by
sandbox-exec (macOS) or bwrap (Linux), reusing the same primitives proven
by the v5.1 git-clone sandbox. Defense-in-depth — even if our own
zip-extract.mjs ever has a bypass, the kernel refuses any write outside
the per-scan temp directory.
New files:
- scanners/lib/vsix-fetch-worker.mjs — sub-process worker. Argv: --url
--tmpdir; emits one JSON line on stdout (ok/sha256/size/source/extRoot
or ok:false/error/code). Silent on stderr. Exit 0/1.
- scanners/lib/vsix-sandbox.mjs — wrapper. Exports buildSandboxProfile,
buildBwrapArgs, buildSandboxedWorker, runVsixWorker. 35s timeout, 1 MB
stdout cap.
Changes:
- scanners/ide-extension-scanner.mjs: fetchAndExtractVsixUrl is now
sandbox-aware (useSandbox option, default true). In-process logic
preserved as fallback. New meta.source.sandbox field:
'sandbox-exec' | 'bwrap' | 'none' | 'in-process'.
- scan(target, { useSandbox }) defaults to true; tests pass false because
globalThis.fetch mocks do not cross process boundaries.
- Windows fallback: in-process with meta.warnings advisory.
Tests:
- 8 new tests in tests/scanners/vsix-sandbox.test.mjs (per-platform
profile generation, worker arg construction, live worker exit
behavior on invalid URLs — no network).
- Existing URL tests updated to opt out of sandbox (useSandbox: false).
- 1344 → 1352 tests, all green.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
36 lines
810 B
JSON
36 lines
810 B
JSON
{
|
|
"name": "llm-security",
|
|
"version": "6.5.0",
|
|
"description": "Security scanning, auditing, and threat modeling for Claude Code projects",
|
|
"type": "module",
|
|
"bin": {
|
|
"llm-security": "./bin/llm-security.mjs"
|
|
},
|
|
"files": [
|
|
"bin/",
|
|
"scanners/",
|
|
"LICENSE",
|
|
"README.md"
|
|
],
|
|
"homepage": "https://git.fromaitochitta.com/open/claude-code-llm-security",
|
|
"engines": {
|
|
"node": ">=18"
|
|
},
|
|
"scripts": {
|
|
"test": "node --test 'tests/**/*.test.mjs'",
|
|
"bump": "node scripts/bump-version.mjs"
|
|
},
|
|
"keywords": [
|
|
"claude-code",
|
|
"security",
|
|
"owasp",
|
|
"llm",
|
|
"plugin"
|
|
],
|
|
"author": "Kjell Tore Guttormsen",
|
|
"license": "MIT",
|
|
"repository": {
|
|
"type": "git",
|
|
"url": "https://git.fromaitochitta.com/fromaitochitta/claude-code-llm-security"
|
|
}
|
|
}
|