Module security 

Security module for AetherShell

This module provides comprehensive security controls for:

• Path validation and traversal prevention (CVSS 8.2)
• Command sanitization and allowlist enforcement (CVSS 9.1)
• Input validation for AI prompts and user input (CVSS 7.8)
• Secure credential management (CVSS 8.7)

All security functions are designed according to DOD standards and OWASP guidelines.

Re-exports

pub use crate::secure_config::SecureApiConfig;

Structs

CommandSecurityConfig

Command allowlist configuration

PathSecurityConfig

Security configuration for path validation

ResourceLimits

Resource limits configuration

SecurityAuditEvent

Security audit event structure for SIEM integration

Enums

ErrorLevel

Error exposure level for security

SecurityEventType

Security event types for audit logging

Functions

check_file_size_limit

Check if a file size is within limits

check_rate_limit

Check if an operation is rate limited

configure_command_security

Configure global command security settings

configure_path_security

Configure global path security settings

configure_resource_limits

Configure global resource limits

create_https_only_async_client

Create an HTTPS-only async client with timeouts (rejects HTTP)

create_https_only_client

Create an HTTPS-only client (rejects HTTP)

create_secure_async_client

Create a secure async HTTP client with proper timeout configuration

create_secure_http_client

Create a secure HTTP client with hardened TLS configuration

get_api_key_env

Get an API key from environment with validation (DEPRECATED - use SecureApiConfig instead)

sanitize_error_message

Sanitize error messages to prevent information disclosure

sanitize_path_in_error

Sanitize path in error messages

sanitize_tui_output

Sanitize TUI output to prevent terminal escape sequence injection

validate_ai_prompt

Validate AI prompt input for injection attacks

validate_api_key_format

NOTE: For secure credential management, use the secrecy crate. This module provides validation and best practices, but actual secret storage should use OS-specific credential stores (Windows Credential Manager, macOS Keychain, etc.)

validate_command

Validate a command is allowed to execute (prevents command injection)

validate_http_url

Validate HTTP URL for SSRF prevention

validate_read_path

Validate a path for read operations (less strict)

validate_safe_path

Validate a path is safe to access (prevents path traversal attacks)

validate_string_input

Validate generic string input

validate_write_path

Validate a path for write operations (more strict)