Merge pull request #1353 from oraios/implement_security_recommendations

Implement security recommendations

.github/workflows/publish.yml

@@ -6,38 +6,13 @@ on:
     tags:
       - 'v*' # Push events to matching v*, i.e. v1.0, v20.15.10
 
-env:
-  PUBLISH_TO_PYPI: true
-
 jobs:
-  build:
-    name: Create GitHub Release
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-      - name: Create Release
-        id: create_release
-        uses: actions/create-release@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # This token is provided by Actions, you do not need to create your own token
-        with:
-          tag_name: ${{ github.ref }}
-          release_name: Release ${{ github.ref }}
-          body: |
-            See [change log](https://github.com/oraios/serena/blob/main/CHANGELOG.md)
-          draft: false
-          prerelease: false
   publish:
     name: Publish the serena-agent package
     runs-on: ubuntu-latest
-
     permissions:
       id-token: write  # Required for trusted publishing
-      contents: write  # Required for updating artifact
-
+      contents: write  # Required for the GH release
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -52,18 +27,11 @@ jobs:
       - name: Build package
         run: uv build
 
-      - name: Upload artifacts to GitHub Release
-        if: env.PUBLISH_TO_PYPI == 'true'
-        uses: softprops/action-gh-release@v2
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v3
         with:
-          tag_name: ${{ github.event.inputs.tag || github.ref_name }}
           files: |
             dist/*.tar.gz
             dist/*.whl
-
-      - name: Publish to TestPyPI
-        run: uv publish --index testpypi
-
       - name: Publish to PyPI (conditional)
-        if: env.PUBLISH_TO_PYPI == 'true'
         run: uv publish

.github/workflows/pytest.yml

@@ -6,6 +6,9 @@ on:
     branches:
       - main
 
+permissions:
+    contents: read
+
 concurrency:
   group: ci-${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true

src/serena/dashboard.py

@@ -6,6 +6,7 @@ import threading
 import time
 import urllib.error
 import urllib.request
+from html import escape
 from pathlib import Path
 from typing import TYPE_CHECKING, Any, Self
 
@@ -391,7 +392,7 @@ class SerenaDashboardAPI:
                 return {
                     "status": "success",
                     "was_cancelled": False,
-                    "message": f"Task with id {request_data.get('task_id')} not found, maybe execution was already finished",
+                    "message": f"Task with id {escape(request_data.get('task_id'))} not found, maybe execution was already finished",
                 }
             except Exception as e:
                 return {"status": "error", "message": str(e), "was_cancelled": False}
@@ -436,7 +437,7 @@ class SerenaDashboardAPI:
         def mark_news_snippet_as_read() -> dict[str, str]:
             try:
                 request_data = request.get_json()
-                news_snippet_id = str(request_data.get("news_snippet_id"))
+                news_snippet_id = escape(str(request_data.get("news_snippet_id")))
                 self._read_news.mark_read(news_snippet_id)
                 return {"status": "success", "message": f"Marked news snippet {news_snippet_id} as read"}
             except Exception as e: