pithead: validate dashboard.host + reset-dashboard targets from .env (#130, #139)#155
Merged
Merged
Conversation
…om .env (#130, #139) #130: dashboard.host is rendered verbatim into the Caddyfile site address but was never validated. A value with a space, newline, or `{`/`}` would break the Caddyfile (or inject directives). Add an is_valid_host check in parse_and_validate_config (hostname/IP chars only), mirroring the stratum_bind validation. #139: reset-dashboard wiped the dirs from a fresh config.json parse, so editing a *.data_dir before reset (without an apply) could `rm -rf` a directory the running stack never used. Resolve the delete targets from .env (the live deployment) instead, assert_safe_dir them, and refuse to run rather than guess if .env doesn't name them. Tests: is_valid_host unit; bad-dashboard.host rejected; reset targets the .env dir (not a config-only path) and refuses without .env dirs. Suite 111 passed, shellcheck clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two small
pitheadsafety fixes from the v1.0 sweep.#130 — validate
dashboard.hostbefore it reaches the Caddyfiledashboard.hostflows verbatim into the generated Caddyfile's site address (generate_caddyfile), but had no validation (unlikestratum_bind). A value containing a space, newline, or{/}would break the Caddyfile — or inject extra reverse-proxy directives. Adds anis_valid_hostcheck inparse_and_validate_config(hostname/IP characters only) that errors early.#139 —
reset-dashboardwipes the live data dirs, not a config-only pathreset-dashboardresolved itsrm -rftargets from a freshconfig.jsonparse. So if you editedp2pool.data_dir/dashboard.data_dirinconfig.jsonbut hadn't runapplyyet, reset would delete the new path (possibly a populated directory you just pointed at) while the running stack still used the old one. Now it resolves the targets from.env(the live deployment),assert_safe_dirs them, and refuses to run rather than guess if.envdoesn't name them.Tests
is_valid_hostunit (hostname/IPv4/IPv6 accepted; space/braces/slash/empty rejected).dashboard.hostis rejected byapply.reset-dashboardtargets the.envdir (asudostub logs, never executes, so nothing is deleted) and ignores a different config-onlydata_dir; and it refuses when.envlacks the dirs.Closes #130. Closes #139.
🤖 Generated with Claude Code