mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-02-19 07:50:43 +01:00
524f42cc28
Implements comprehensive security hardening for pulse-sensor-proxy: - Privilege drop from root to unprivileged user (UID 995) - Hash-chained tamper-evident audit logging with remote forwarding - Per-UID rate limiting (0.2 QPS, burst 2) with concurrency caps - Enhanced command validation with 10+ attack pattern tests - Fuzz testing (7M+ executions, 0 crashes) - SSH hardening, AppArmor/seccomp profiles, operational runbooks All 27 Phase 1 tasks complete. Ready for production deployment.
32 lines
609 B
Go
32 lines
609 B
Go
package main
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func FuzzValidateCommand(f *testing.F) {
|
|
seeds := []string{
|
|
"sensors -j",
|
|
"ipmitool sdr",
|
|
"sensors",
|
|
"ipmitool lan print",
|
|
}
|
|
for _, seed := range seeds {
|
|
f.Add(seed)
|
|
}
|
|
|
|
f.Fuzz(func(t *testing.T, input string) {
|
|
fields := strings.Fields(input)
|
|
if len(fields) == 0 {
|
|
return
|
|
}
|
|
cmd := fields[0]
|
|
args := []string{}
|
|
if len(fields) > 1 {
|
|
args = fields[1:]
|
|
}
|
|
validateCommand(cmd, args) // ensure no panics
|
|
})
|
|
}
|