Unblock CI security stage: gitleaks fixture allowlist, anyhow + ws advisories (#421) #980

Merged

Brouie merged 1 commit from qa/421-ci-security-stage-green into main

2026-06-30 21:55:20 +00:00

Brouie commented

2026-06-30 18:38:08 +00:00

(Migrated from gitlab.com)

Closes the security-stage script failures I flagged on #421. Three separate things, all gating the same cascade — when any security job exits non-zero the whole test stage is skipped, so the #421 functional gates never even run.

gitleaks

generic-api-key was flagging the synthetic terra1ustcquote293 fixture in indexer/tests/common/mod.rs:384 (the #293 route-slippage seed) as a leaked secret. The .gitleaks.toml secret-allowlist already exempts terra1[a-z0-9]{38,} for real on-chain addresses; short test addresses fall under the bound. Widened it to {10,} so synthetic fixtures are covered too. Re-ran scripts/ci/gitleaks-scan-tracked.sh --verbose → no leaks found.

cargo-audit (indexer)

anyhow 1.0.102 tripped RUSTSEC-2026-0190 (unsoundness in Error::downcast_mut(), published 06-25). Bumped to 1.0.103, lockfile-only. cargo audit --deny warnings exit 0; indexer lib 158/0.

npm-audit (frontend)

ws <=7.5.10 (high, memory-exhaustion DoS) plus undici and esbuild dev-server advisories. npm audit fix — lockfile-only (ws 7.5.11, undici 7.28.0, esbuild 0.27.7), package.json untouched. The cosmjs/uuid moderate chain stays as the pre-accepted risk in docs/supply-chain-security.md; it's below the --audit-level=high gate. npm audit --audit-level=high --omit=dev exit 0, tsc -b clean.

Heads up — pipeline can't actually go green yet

Independent of these fixes, every main pipeline since ~14:50 is failing with failure_reason=ci_quota_exceeded across all jobs (the shared-runner minutes are out). So this MR clears the script failures, but the pipeline still won't run green until the runner minutes/billing get sorted. Flagging that separately on the issue.

Closes the security-stage script failures I flagged on #421. Three separate things, all gating the same cascade — when any security job exits non-zero the whole `test` stage is skipped, so the #421 functional gates never even run. ### gitleaks `generic-api-key` was flagging the synthetic `terra1ustcquote293` fixture in `indexer/tests/common/mod.rs:384` (the #293 route-slippage seed) as a leaked secret. The `.gitleaks.toml` secret-allowlist already exempts `terra1[a-z0-9]{38,}` for real on-chain addresses; short test addresses fall under the bound. Widened it to `{10,}` so synthetic fixtures are covered too. Re-ran `scripts/ci/gitleaks-scan-tracked.sh --verbose` → no leaks found. ### cargo-audit (indexer) `anyhow` 1.0.102 tripped RUSTSEC-2026-0190 (unsoundness in `Error::downcast_mut()`, published 06-25). Bumped to 1.0.103, lockfile-only. `cargo audit --deny warnings` exit 0; indexer lib 158/0. ### npm-audit (frontend) `ws` <=7.5.10 (high, memory-exhaustion DoS) plus `undici` and `esbuild` dev-server advisories. `npm audit fix` — lockfile-only (ws 7.5.11, undici 7.28.0, esbuild 0.27.7), `package.json` untouched. The cosmjs/uuid moderate chain stays as the pre-accepted risk in `docs/supply-chain-security.md`; it's below the `--audit-level=high` gate. `npm audit --audit-level=high --omit=dev` exit 0, `tsc -b` clean. ### Heads up — pipeline can't actually go green yet Independent of these fixes, every main pipeline since ~14:50 is failing with `failure_reason=ci_quota_exceeded` across *all* jobs (the shared-runner minutes are out). So this MR clears the script failures, but the pipeline still won't run green until the runner minutes/billing get sorted. Flagging that separately on the issue.

Brouie commented

2026-06-30 18:38:08 +00:00

(Migrated from gitlab.com)

assigned to @Brouie

Brouie commented

2026-06-30 18:38:29 +00:00

(Migrated from gitlab.com)

changed the description

Brouie commented

2026-06-30 18:38:43 +00:00

(Migrated from gitlab.com)

mentioned in issue #421

PlasticDigits commented

2026-06-30 18:40:29 +00:00

(Migrated from gitlab.com)

Security review — MR !980

Commit reviewed: 1b5a035974b8de1372d45e6cc979fe92fe3c352d
Base: d5f277e85ddbd63bba6d4f01becd58fa66df4dc2

Scope

.gitleaks.toml — widen terra1 secret allowlist ({38,} → {10,}) for synthetic test fixtures
indexer/Cargo.lock — anyhow 1.0.102 → 1.0.103 (RUSTSEC-2026-0190)
frontend-dapp/package-lock.json — npm audit fix (ws 7.5.11, undici 7.28.0, transitive Babel/js-yaml bumps)

Analysis

Gitleaks allowlist — regexTarget = "secret" only suppresses matches whose captured secret matches terra1[a-z0-9]{10,}. Real on-chain addresses were already covered at {38,}; the change unblocks short synthetic fixtures in test data (e.g. terra1factory, terra1pairrouteabc). No attacker-controlled input reaches this control; exploitation would require a malicious insider deliberately crafting a terra1-prefixed high-entropy string to evade generic-api-key, while BIP39/JWT/other default rules remain active. A path-scoped allowlist for indexer/tests/** would be tighter, but this is a CI false-positive fix, not a runtime authz or injection change.
anyhow bump — Remediates published unsoundness (Error::downcast_mut()); indexer does not call downcast_mut. Net security improvement.
npm lockfile — Resolves known advisories (ws memory-exhaustion DoS, undici/esbuild dev-server issues). ws is a WalletConnect peer dep; production audit gate uses --omit=dev. No new production dependency surface or downgrades introduced.

Outcome

FINDINGS: 0 medium+

Security review: no medium+ findings on this diff. No inline threads.

Prior MR security comments: none to re-validate.

## Security review — MR !980 **Commit reviewed:** `1b5a035974b8de1372d45e6cc979fe92fe3c352d` **Base:** `d5f277e85ddbd63bba6d4f01becd58fa66df4dc2` ### Scope - `.gitleaks.toml` — widen `terra1` secret allowlist (`{38,}` → `{10,}`) for synthetic test fixtures - `indexer/Cargo.lock` — `anyhow` 1.0.102 → 1.0.103 (RUSTSEC-2026-0190) - `frontend-dapp/package-lock.json` — `npm audit fix` (`ws` 7.5.11, `undici` 7.28.0, transitive Babel/js-yaml bumps) ### Analysis 1. **Gitleaks allowlist** — `regexTarget = "secret"` only suppresses matches whose captured secret matches `terra1[a-z0-9]{10,}`. Real on-chain addresses were already covered at `{38,}`; the change unblocks short synthetic fixtures in test data (e.g. `terra1factory`, `terra1pairrouteabc`). No attacker-controlled input reaches this control; exploitation would require a malicious insider deliberately crafting a `terra1`-prefixed high-entropy string to evade `generic-api-key`, while BIP39/JWT/other default rules remain active. A path-scoped allowlist for `indexer/tests/**` would be tighter, but this is a CI false-positive fix, not a runtime authz or injection change. 2. **`anyhow` bump** — Remediates published unsoundness (`Error::downcast_mut()`); indexer does not call `downcast_mut`. Net security improvement. 3. **npm lockfile** — Resolves known advisories (`ws` memory-exhaustion DoS, `undici`/`esbuild` dev-server issues). `ws` is a WalletConnect peer dep; production audit gate uses `--omit=dev`. No new production dependency surface or downgrades introduced. ### Outcome **FINDINGS: 0** medium+ Security review: **no medium+ findings** on this diff. No inline threads. Prior MR security comments: none to re-validate.

PlasticDigits commented

2026-06-30 21:55:21 +00:00

(Migrated from gitlab.com)

mentioned in commit c1c5b9cf33

mentioned in commit c1c5b9cf339719921724081e02c342c2b98ecdcb