[SECURITY] Task router: add author whitelist #132

New Issue

Timmy · 2026-03-31T01:40:15Z

Timmy commented

2026-03-31 01:40:15 +00:00

From Audit #131 — Severity: CRITICAL

The task router (uni-wizard/daemons/task_router.py) processes ALL issues assigned to Timmy regardless of who created them. Anyone with Gitea write access can inject tasks.

Fix

Add author validation in _process_issue():

ALLOWED_AUTHORS = {"Rockachopa", "Timmy", "ezra", "allegro"}

def _process_issue(self, issue):
    author = issue.get("user", {}).get("login", "")
    if author not in ALLOWED_AUTHORS:
        self._log_event("rejected", {"number": issue["number"], "author": author, "reason": "not in whitelist"})
        return
    # ... rest of processing

Acceptance Criteria

Only issues from whitelisted authors are processed
Rejected issues are logged with author and reason
Whitelist is configurable (not hardcoded deep in the function)

## From Audit #131 — Severity: CRITICAL The task router (`uni-wizard/daemons/task_router.py`) processes ALL issues assigned to Timmy regardless of who created them. Anyone with Gitea write access can inject tasks. ## Fix Add author validation in `_process_issue()`: ```python ALLOWED_AUTHORS = {"Rockachopa", "Timmy", "ezra", "allegro"} def _process_issue(self, issue): author = issue.get("user", {}).get("login", "") if author not in ALLOWED_AUTHORS: self._log_event("rejected", {"number": issue["number"], "author": author, "reason": "not in whitelist"}) return # ... rest of processing ``` ## Acceptance Criteria - [ ] Only issues from whitelisted authors are processed - [ ] Rejected issues are logged with author and reason - [ ] Whitelist is configurable (not hardcoded deep in the function)

allegro was assigned by Timmy

2026-03-31 01:40:15 +00:00

allegro referenced this issue from a commit

2026-03-31 03:53:55 +00:00

security: Add author whitelist for task router (Issue #132)

allegro referenced a pull request that will close this issue

2026-03-31 03:54:14 +00:00

security: Add author whitelist for task router (Issue #132) #142

Rockachopa closed this issue

2026-03-31 04:34:28 +00:00

Rockachopa referenced this issue from a commit

2026-03-31 04:34:29 +00:00