gsadmin/sencho
1
0
Fork 0
mirror of https://github.com/Studio-Saelix/sencho.git synced 2026-08-24 17:36:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(security): surface Compose internet-reachability exposure in posture (#1442)

Browse Source 
* feat(security): surface Compose internet-reachability exposure in posture

Builds a per-stack per-service exposure descriptor from the rendered
effective Compose model, cached at deploy/update time, and joins it into
the Security action posture. A service is publicly exposed when it
publishes a port on a non-loopback host IP or uses host networking.

The exposure cache lives in a new stack_exposure table, refreshed inside
ComposeService.deployStack and updateStack (covering all funneled paths:
manual, scheduler, mesh, templates, labels, App Store, Git, webhooks).
Cleanup runs on stack delete, blueprint withdrawal, and node delete.

The overview route intersects the exposed image set with the existing
per-image suppression-aware Critical/High tally, so a clean public
nginx does not escalate posture. The scan sheet shows a "Published
service" or "Internal only" evidence badge per image.

* fix(test): provide fresh auto-close proc for exposure spawn in stall tests

Two deployStack idle-stall tests used mockSpawn.mockReturnValue(proc)
which returned the same already-closed process for the new config spawn
added by the exposure refresh. The renderConfig promise hung waiting for
a close event that had already fired.

The fix uses mockImplementation to return the controlled proc for the
first spawn (up) and a fresh auto-closing proc for the second spawn
(config via refreshExposureCache).

* fix(security): tighten loopback detection, clarify exposure semantics, drop internal-only badge

- Expand isLoopback to cover full 127.0.0.0/8 range (127.0.0.2 etc)
- Clarify that exposure is configured (Compose model), not live topology
- Remove "Internal only" badge: false is not proof of non-exposure when
  other stacks using the same image may lack a cached descriptor
This commit is contained in:
Anso
2026-06-24 23:22:13 -04:00
committed by GitHub
parent db8bb70b7d
commit 3a22f59057
11 changed files with 576 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frontend/src/components/VulnerabilityScanSheet.tsx
+8 -3
View File
@@ -528,9 +528,14 @@ export function VulnerabilityScanSheet({
}
}, [scan]);
const meta = scan
? `${scan.total_vulnerabilities} vulns · ${scan.fixable_count} fixable · ${scan.triggered_by}`
: (loading ? 'Loading…' : 'No scan');
const meta = scan ? (
<span className="inline-flex flex-wrap items-center gap-2">
{scan.total_vulnerabilities} vulns · {scan.fixable_count} fixable · {scan.triggered_by}
{scan.publicly_exposed === true && (
<EvidenceTag tone="warn">Published service</EvidenceTag>
)}
</span>
) : (loading ? 'Loading…' : 'No scan');
const footerContext = scan
? `Scanned ${formatTimeAgo(new Date(scan.scanned_at).getTime())}`