dsh-apk-vm 0.0.0-stage → 0.3.13

package/SECURITY.md

@@ -0,0 +1,108 @@
+# Security Policy
+
+## Supported versions
+
+| Version | Supported |
+| --- | --- |
+| 0.3.x (current) | Yes |
+| < 0.3 | No |
+
+The plugin is a local development tool. It is not designed or hardened as a multi-tenant or
+network-exposed service.
+
+## Reporting a vulnerability
+
+**Please do not open a public issue for security problems.**
+
+Preferred: use the repository's GitHub **Security** tab → **Report a vulnerability**
+(private security advisory). Include:
+
+- affected version and platform (OS, DSH profile, Android SDK/emulator versions);
+- a minimal reproduction (routes/config involved, request payloads, expected vs. actual);
+- impact assessment — what an attacker gains (guest root shell, host command execution, data
+  exposure, denial of service, …);
+- any logs/screenshots with secrets, tokens and personal paths removed.
+
+If you cannot use private advisories, contact the maintainers through the repository's listed
+contact channel and ask for a private reporting route.
+
+**Do not** test against systems you do not own, do not access other users' data, and do not
+publish details before a fix is available. Good-faith research within these bounds is welcome.
+
+### What to expect
+
+This is a small open-source project maintained on a best-effort basis:
+
+1. Acknowledgement of the report, aiming for within 7 days.
+2. Triage and an initial impact assessment.
+3. A private fix and a coordinated disclosure date (normally once a release with the fix is
+   available); the advisory credits the reporter unless anonymity is requested.
+
+## Scope
+
+In scope:
+
+- this repository's code: [index.js](index.js), [client.js](client.js), [lib/](lib),
+  [lib/ws.js](lib/ws.js), the route surface under `/apk-vm/*`;
+- the vendored scrcpy server JAR provenance/redistribution
+  ([NOTICE](NOTICE)) — e.g. a mismatch between the shipped artifact and upstream v5.0.1;
+- documentation that would cause a user to expose the plugin unsafely.
+
+Out of scope (report upstream):
+
+- **DeepSeek Harness** itself (auth, Web server, plugin runtime) — report to the DSH project;
+- the **Android Emulator, adb and AOSP system images** — report to the Android/AOSP projects;
+- the **scrcpy** project — report to [Genymobile/scrcpy](https://github.com/Genymobile/scrcpy)
+  (the JAR in this repository is upstream's unmodified v5.0.1 server build);
+- **dsh-better-sidebar** — a separate community plugin.
+
+## Threat model and known security-relevant behavior
+
+The following behavior is intentional; it is documented here so it is not mistaken for a
+vulnerability. Reports that rely on it being intentional will be closed as informational unless
+they demonstrate a way to exceed the stated boundaries.
+
+1. **A rooted, debuggable Android guest is started on the user's machine.** The image is
+   `userdebug`; `adb root` is applied after boot, `ro.debuggable=1` and `ro.adb.secure=0`. Any APK
+   installed in the VM runs inside that guest; the guest is not a security boundary against the
+   host beyond the emulator's own isolation. Do not store sensitive data in the AVD.
+2. **`/apk-vm/debug/shell` executes arbitrary commands inside the guest** (as root), and
+   `/apk-vm/debug/action` can force-stop, clear data or uninstall packages. This is the product
+   feature. Commands run in the Android guest, not on the host.
+3. **`/apk-vm/debug/push` and `/pull` move files** between the host and the guest, constrained to
+   `/data/local/tmp`, `/sdcard`, `/storage/emulated/0` on the guest and to allowed local roots/temp
+   on the host.
+4. **The `apk_vm` Agent tool is registered for all agents in the DSH profile** and exposes the
+   same surface to them. Treat agent access to this plugin as equivalent to giving the agent a
+   rooted Android device (and the ability to install APKs and run guest commands).
+5. **All routes are same-origin only, and are loopback-only by default.** The HTTP routes reject
+   cross-origin requests; additionally, every `/apk-vm/*` request and the WebSocket upgrade
+   rejects non-loopback TCP peers unless `allowRemote: true` is explicitly set. Anything that can
+   make same-origin requests to the DSH Web server — including a compromised page in the same
+   origin, a malicious browser extension, or a reverse proxy that adds authentication but
+   forwards `/apk-vm/*` — inherits this capability. **Do not expose the DSH Web port to
+   untrusted networks.** If you must, add authentication at a trusted proxy and set
+   `allowRemote: true` deliberately; keep the DSH auth token secret.
+6. **Host commands are never built as shell strings.** `adb`, `emulator`, `sdkmanager` and
+   `avdmanager` are spawned with `argv` arrays; paths and payload sizes are validated/bounded
+   (JSON bodies ≤ 64 KiB, APK uploads ≤ 500 MiB with ZIP/APK magic validation, bounded
+   stdout/stderr, APK paths must exist and end in `.apk`, push/pull targets restricted as above).
+   Bypassing these bounds is in scope if demonstrated.
+7. **Upload and environment setup are privileged local actions.** `/apk-vm/upload` writes the
+   uploaded APK to the OS temp directory and installs it into the guest; `/apk-vm/setup`
+   `create-avd` writes an AVD under the user's AVD home. `/apk-vm/setup` `install-image` runs
+   `sdkmanager --install` only when `allowSetupDownloads: true` is configured (default `false`),
+   because it is a large network download; it is never triggered automatically.
+8. **The plugin does not send telemetry** or contact third-party services on its own; it talks to
+   the local adb/emulator and the same-origin DSH Web server. The only network activity comes
+   from the user's own `sdkmanager` when they explicitly run the opt-in `install-image` action.
+
+## Hardening status
+
+The released plugin applies same-origin and loopback checks to every `/apk-vm/*` HTTP route and
+the `/apk-vm/ws` upgrade, bounded payloads for JSON and uploads, argument-array process spawning,
+and a restricted push/pull path set. The multi-touch (`/touch`), clipboard (`/clipboard`) and
+artifact-download routes are part of the same origin/loopback surface. There is no separate
+authentication token of its own: it relies on the DSH Web server's session and on the operator
+keeping that server local/trusted. Run this plugin only on a machine and local network you trust;
+do not treat the rooted Android guest as a security boundary.