Fix security audit vulnerabilities - #793
Conversation
… android cleartext - Restructured `MEDICAL_CAPABILITIES` in `prohibitions.py` to allow FDA low-risk general wellness features (fitness, sleep, nutrition tracking) while retaining strict blocks on clinical and diagnostic functions. - Implemented HMAC signing and verification for OAuth state parameters in `auth.py` using `CIRIS_OAUTH_STATE_SECRET` to prevent tampering/CSRF, with an unreachable-code fix for the legacy unsigned fallback path. - Disabled cleartext traffic in AndroidManifest.xml. Co-authored-by: emooreatx <3317461+emooreatx@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
|
|
1 similar comment
|
|
- Implement HMAC state signing for OAuth flow using JWT_SECRET_KEY, preventing CSRF/replay vulnerabilities, and removing the legacy insecure fallback. - Move low-risk general wellness/fitness terminology (e.g. 'wellness', 'vitals', 'sleep_tracking') from the restricted `MEDICAL_CAPABILITIES` to `STANDARD_OPERATIONS` to align with FDA low-risk policies and permit personal assistant capabilities, while maintaining strict blocks on clinical features. - Disable global cleartext traffic in the Android app, creating a network security config that strictly limits unencrypted traffic to `.local` and `localhost` domains to support mDNS-based local integrations like Home Assistant. Co-authored-by: emooreatx <3317461+emooreatx@users.noreply.github.com>
1 participant
Resolves issues highlighted in
SECURITY_AUDIT_PROHIBITED_CAPABILITIES.mdandOAUTH_STATE_SECURITY_AUDIT.md. Fixes the OAuth HMAC verification implementation so it runs seamlessly in multi-process configurations and properly supports backward compatibility during deployment transitions. Aligns prohibition blocking with FDA guidance on general wellness devices vs. medical devices. Removes unencrypted traffic vulnerability from Android manifest.PR created automatically by Jules for task 15905480894389108743 started by @emooreatx