SenSu

AskaEth/SenSu

Fork 0

Commit Graph

Author	SHA1	Message	Date
qinglong	634496d975	security: Sentinel 路由鉴权 + API Key CSRF + SSRF 防护修复: - Sentinel 路由 require_auth=False → True (严重: 未认证可访问) - API Key 创建/删除加 csrf_protect=True - SSRF 防护: 测试连接仅允许 http/https scheme - 插件网络鉴权: 已加载插件自动放行 (不再要求 plugin.network.access) - Sentinel 权限列表补充 plugin.network.access Co-Authored-By: Claude <noreply@anthropic.com>	2026-06-13 15:13:56 +08:00
AskaEth	e6875f0b4b	Initial commit: SenSu Alpha 0.2.0 - 13-service async plugin framework - Textual TUI with CLI fallback - Plugin hot-reload + permission system - Web management panel (aiohttp) - Bridge-based inter-module communication - 10 regression tests Fixes applied: - PBKDF2-SHA256 auth (was plain SHA256) - Auth bypass removed (was allow-all on fail) - Bare excepts replaced with logged errors - CatFramework/DreamSu -> SenSu naming unified - ServiceManager: health checks + startup_order - Env var credentials (SENSU_ADMIN_PASSWORD etc)	2026-06-10 12:28:05 +08:00

Author

SHA1

Message

Date

qinglong

634496d975

security: Sentinel 路由鉴权 + API Key CSRF + SSRF 防护

修复:
- Sentinel 路由 require_auth=False → True (严重: 未认证可访问)
- API Key 创建/删除加 csrf_protect=True
- SSRF 防护: 测试连接仅允许 http/https scheme
- 插件网络鉴权: 已加载插件自动放行 (不再要求 plugin.network.access)
- Sentinel 权限列表补充 plugin.network.access

Co-Authored-By: Claude <noreply@anthropic.com>

2026-06-13 15:13:56 +08:00

AskaEth

e6875f0b4b

Initial commit: SenSu Alpha 0.2.0

- 13-service async plugin framework
- Textual TUI with CLI fallback
- Plugin hot-reload + permission system
- Web management panel (aiohttp)
- Bridge-based inter-module communication
- 10 regression tests

Fixes applied:
- PBKDF2-SHA256 auth (was plain SHA256)
- Auth bypass removed (was allow-all on fail)
- Bare excepts replaced with logged errors
- CatFramework/DreamSu -> SenSu naming unified
- ServiceManager: health checks + startup_order
- Env var credentials (SENSU_ADMIN_PASSWORD etc)

2026-06-10 12:28:05 +08:00

2 Commits