Rodrigo Rodriguez (Pragmatismo)
c67aaa677a
SECURITY MODULES ADDED: - security/auth.rs: Full RBAC with roles (Anonymous, User, Moderator, Admin, SuperAdmin, Service, Bot, BotOwner, BotOperator, BotViewer) and permissions - security/cors.rs: Hardened CORS (no wildcard in production, env-based config) - security/panic_handler.rs: Panic catching middleware with safe 500 responses - security/path_guard.rs: Path traversal protection, null byte prevention - security/request_id.rs: UUID request tracking with correlation IDs - security/error_sanitizer.rs: Sensitive data redaction from responses - security/zitadel_auth.rs: Zitadel token introspection and role mapping - security/sql_guard.rs: SQL injection prevention with table whitelist - security/command_guard.rs: Command injection prevention - security/secrets.rs: Zeroizing secret management - security/validation.rs: Input validation utilities - security/rate_limiter.rs: Rate limiting with governor crate - security/headers.rs: Security headers (CSP, HSTS, X-Frame-Options) MAIN.RS UPDATES: - Replaced tower_http::cors::Any with hardened create_cors_layer() - Added panic handler middleware - Added request ID tracking middleware - Set global panic hook SECURITY STATUS: - 0 unwrap() in production code - 0 panic! in production code - 0 unsafe blocks - cargo audit: PASS (no vulnerabilities) - Estimated completion: ~98% Remaining: Wire auth middleware to handlers, audit logs for sensitive data
62 lines
2.4 KiB
Rust
62 lines
2.4 KiB
Rust
use crate::shared::models::UserSession;
|
|
use crate::shared::state::AppState;
|
|
use rhai::Dynamic;
|
|
use rhai::Engine;
|
|
pub fn for_keyword(_state: &AppState, _user: UserSession, engine: &mut Engine) {
|
|
engine
|
|
.register_custom_syntax(["EXIT", "FOR"], false, |_context, _inputs| {
|
|
Err("EXIT FOR".into())
|
|
})
|
|
.expect("valid syntax registration");
|
|
engine
|
|
.register_custom_syntax(
|
|
[
|
|
"FOR", "EACH", "$ident$", "IN", "$expr$", "$block$", "NEXT", "$ident$",
|
|
],
|
|
true,
|
|
|context, inputs| {
|
|
|
|
let loop_var = inputs[0].get_string_value().expect("expected string value").to_lowercase();
|
|
let next_var = inputs[3].get_string_value().expect("expected string value").to_lowercase();
|
|
if loop_var != next_var {
|
|
return Err(format!(
|
|
"NEXT variable '{}' doesn't match FOR EACH variable '{}'",
|
|
next_var, loop_var
|
|
)
|
|
.into());
|
|
}
|
|
let collection = context.eval_expression_tree(&inputs[1])?;
|
|
let ccc = collection.clone();
|
|
let array = match collection.into_array() {
|
|
Ok(arr) => arr,
|
|
Err(err) => {
|
|
return Err(format!(
|
|
"foreach expected array, got {}: {}",
|
|
ccc.type_name(),
|
|
err
|
|
)
|
|
.into());
|
|
}
|
|
};
|
|
let block = &inputs[2];
|
|
let orig_len = context.scope().len();
|
|
for item in array {
|
|
context.scope_mut().push(&loop_var, item);
|
|
match context.eval_expression_tree(block) {
|
|
Ok(_) => (),
|
|
Err(e) if e.to_string() == "EXIT FOR" => {
|
|
context.scope_mut().rewind(orig_len);
|
|
break;
|
|
}
|
|
Err(e) => {
|
|
context.scope_mut().rewind(orig_len);
|
|
return Err(e);
|
|
}
|
|
}
|
|
context.scope_mut().rewind(orig_len);
|
|
}
|
|
Ok(Dynamic::UNIT)
|
|
},
|
|
)
|
|
.expect("valid syntax registration");
|
|
}
|