docs: update README.md - #17
Merged
Merged
Conversation
Roasbeef
force-pushed
the
update-readme
branch
from
January 14, 2026 03:07
74124c5 to
86f9d5b
Compare
tulbox
added a commit
to tulbox/obsidian-claude-code
that referenced
this pull request
Feb 28, 2026
Implements fixes for a full security audit (SECURITY-FIXES.md) addressing critical, high, and moderate severity issues. Skipped only Roasbeef#14 (venv relocation, out of scope for this pass). CRITICAL: - Bash "Always Allow" capped to session-only; persistent entries auto-removed on load (Roasbeef#1) - rebuild_vault_index tool removed; indexing goes through Bash permission flow (Roasbeef#2) HIGH: - execute_command requires allowlisted command IDs (configurable in settings); non-allowlisted rejected outright (Roasbeef#3) - create_note requires approval + path traversal/dot-obsidian validation in both AgentController and ObsidianMcpServer (Roasbeef#3) - process.env filtered to ENV_ALLOWLIST before passing to subprocess (Roasbeef#4) - Skills: canUseTool confirmed authoritative; discovered skills logged via Notice on load (Roasbeef#5) - vault-search SQL injection fixes: parameterized queries, --where removed, dataview.py keyword blocklist, --db-path validated (Roasbeef#6) - Prompt injection defense: hardcoded SECURITY_SYSTEM_PROMPT appended via SDK appendSystemPrompt + vault CLAUDE.md second layer (Roasbeef#7) MODERATE: - API key encrypted with Electron safeStorage (OS keychain); auto-migrates plaintext on first load; status indicator in settings (Roasbeef#8) - Base URL validation: HTTPS-only, localhost requires Developer Mode toggle, warning for custom endpoints (Roasbeef#9) - autoApproveVaultWrites default flipped to false (Roasbeef#10) - Unknown/new tools denied by default (permission modal) (Roasbeef#11) - Per-query rate limiting with configurable limits and RateLimitModal; limits double on user "continue" to avoid re-prompting (Roasbeef#12) - Tool output truncated at 100K chars in AgentController (SDK level) and ChatView (UI level) as defense-in-depth (Roasbeef#13) - Claude CLI executable permission check: reject world/group-writable (Roasbeef#15) - Symlink escape prevention in vault-search indexer (Roasbeef#16) - Plugin unload aborts in-flight queries via detachLeavesOfType -> onClose -> cancelStream chain (Roasbeef#17) DRY / refactoring: - Hoisted READ_ONLY_TOOLS, SAFE_UI_TOOLS, WRITE_TOOLS to module-level Sets - Hoisted ENV_ALLOWLIST to module-level const - Extracted requireApproval() helper (eliminates 5 repeated modal patterns) - Static imports for PermissionModal/RateLimitModal (was runtime require()) - safeStorage getSafeStorage() lazy singleton (was 3 require("electron")) - Rate limit state instance-scoped (reset per query from immutable defaults) Tool result parsing: - Added ToolResultBlock/ToolResultUpdate types for SDK tool_result blocks - processAssistantMessage returns toolResults alongside text/tools - extractToolResultText handles string/array/object content formats - Tool results processed with truncation before UI events PermissionModal hardening: - Added resolved flag preventing double-resolution - ESC/overlay close now resolves as deny (prevents hanging promises) Bash command blocklist (hard-deny, no user override): - 14 regex patterns: macOS security, keyctl, secret-tool, GPG export, SSH keys, AWS/Azure/GCloud creds, PEM/key files, env dumps, pass, 1Password - Enforced before any approval logic (even when requireBashApproval=false) Tests: - Security system prompt verification - 8 blocked Bash command tests (each pattern category + bypass-proof) - Base URL validation tests (6 cases) - All 579 tests pass
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.