security-review

name	security-review
description	Audit LogHunter for untrusted-log handling, regex denial of service, unsafe path behavior, command execution, information disclosure, dependency risk, and defensive-only scope.
license	MIT
metadata	{"project":"loghunter-cli","domain":"application-security"}

Security Review

Threat model

LogHunter processes attacker-influenced text from authentication logs. A malicious record may contain:

• Extremely long fields.
• Unexpected Unicode.
• Invalid IP addresses.
• Oversized numeric values.
• Crafted text intended to trigger expensive regex behavior.
• Terminal control sequences.
• Misleading usernames or hostnames.

Input files and output paths may also be invalid, inaccessible, or intentionally confusing.

Non-negotiable rules

• No eval.
• No exec.
• No dynamic import from input.
• No shell command built from log data.
• No subprocess execution in the core analyzer.
• No automatic firewall or account changes.
• No network enrichment in the offline analysis path.
• No telemetry.
• No modification of source logs.
• No secrets or private production logs in fixtures.

Regex denial-of-service review

Inspect every regex for:

• Nested quantifiers.
• Ambiguous .* followed by overlapping alternatives.
• Repetition around optional groups.
• Patterns built dynamically from input.
• Missing anchors where the format is known.
• Unbounded capture of fields that can be tokenized explicitly.

Prefer named groups and explicit separators.

Stable patterns should be compiled once.

Where a pattern remains permissive, add a test with a long non-matching line and measure that execution remains reasonable.

Terminal safety

Log fields may contain escape sequences.

• Do not render untrusted content as Rich markup unless escaped or markup is disabled for that value.
• Avoid allowing log text to alter terminal formatting.
• Limit or truncate raw ignored-line samples.
• Use textual labels in addition to color.

Path safety

• Use Path.
• Validate that input is a regular file.
• Handle symlink policy explicitly if it becomes security relevant.
• Do not overwrite output without an accepted policy.
• For report exports, reject output symlinks and non-regular entries, reject source/output same-file aliases, require an existing directory parent, and use a completed destination-local temporary file before commit.
• Avoid exposing unnecessary absolute paths in ordinary errors.
• Preserve useful diagnostic context internally.
• Never delete or modify the input file.

Resource exhaustion

Review:

• Whole-file reads.
• Retention of every raw line.
• Unbounded ignored-line samples.
• Per-source state that never expires.
• Extremely large usernames or hostnames retained in findings.
• Repeated sorting of large collections.

Prefer streaming, bounded deques, bounded samples, and explicit truncation in presentation.

Parsing integrity

• Validate IPs with ipaddress.
• Range-check ports.
• Reject impossible timestamps.
• Do not fabricate values when fields are absent.
• Keep unsupported input distinct from valid events.
• Preserve line numbers for traceability.

Error handling

Expected failures:

• Missing file.
• Permission denied.
• Empty file.
• Unsupported records.
• Invalid configuration.
• Export path failure.

These should produce concise messages and stable exit codes, not raw tracebacks.

Unexpected failures must not be swallowed. A debug mode may expose chained diagnostics, but normal output should avoid leaking environment details unnecessarily.

Dependency review

For every new production dependency verify:

• It is necessary.
• It is maintained.
• Its transitive footprint is acceptable.
• It does not add network behavior unexpectedly.
• It is pinned through the lockfile.
• The security benefit outweighs added attack surface.

Defensive scope

Reject changes that turn LogHunter into:

• A credential attack tool.
• An evasion tool.
• An automatic blocking or retaliation system.
• A data-exfiltration mechanism.
• A remote collection agent without an explicit new product decision.

Required security tests

• Long unrelated line.
• Escape-sequence-containing username or hostname presentation.
• Invalid IP and port.
• Truncated input.
• Unreadable file.
• Output path failure.
• No traceback for expected errors.
• Existing output remains unchanged when serialization, temporary writes, or replacement fail.
• CSV formula-leading usernames are protected only in the username cell while JSON remains lossless.
• Bounded ignored-line samples.
• No network calls in standard tests.

Review output

Security findings must state:

• Severity.
• Exploitable or failure scenario.
• Exact code location.
• Minimal safe correction.
• Regression test required.