Complete remediation follow-up hardening

Author: FrnkMrz

.github/workflows/ci.yml

@@ -18,6 +18,8 @@ jobs:
           python -m pip install -e .[dev]
       - name: Ruff
         run: ruff check .
+      - name: Bandit web hardening scan
+        run: bandit -r -ll src/pcap2llm/web/
 
   test:
     runs-on: ubuntu-latest

CHANGELOG.md

@@ -6,6 +6,18 @@ The format is intentionally simple and optimized for humans reading repo history
 
 ## Unreleased
 
+### Fixed — 2026-04-25 (remediation hardening follow-up)
+
+- Completed the remediation-plan hardening pass:
+  - `share` now pseudonymizes endpoint identifiers (`ip`, `hostname`) as well as subscriber identifiers.
+  - summary conversations are covered by a pipeline regression test that verifies no raw endpoint IPs remain.
+  - burst detection now uses packet order instead of timestamp sorting, including reordered-capture coverage.
+  - web support-file paths are limited to per-job uploads plus `PCAP2LLM_WEB_SUPPORT_FILES_ROOT` / local workspace roots.
+  - external LLM handoff commands now have regression coverage for refusing unsafe keep modes unless explicitly overridden.
+  - profile recommendation hard gates and dominant signaling protocol selection have direct regression coverage.
+- CI now runs a Bandit high-confidence web hardening scan with `bandit -r -ll src/pcap2llm/web/`.
+- Privacy and sharing docs were updated to reflect that `share` pseudonymizes endpoints.
+
 ### Fixed — 2026-04-24 (web runtime and local smoke checks)
 
 - **Web GUI runtime compatibility**:

docs/ANLEITUNG_DE.md

@@ -243,7 +243,7 @@ Privacy ist absichtlich von der Profilwahl getrennt.
 Typische Startpunkte:
 
 - `internal`: lokal, unveraendert
-- `share`: intern teilen, Subscriber-Daten pseudonymisieren
+- `share`: intern teilen, Endpunkte und Subscriber-Daten pseudonymisieren
 - `prod-safe`: staerker schuetzen, bevor du nach aussen gehst
 - `llm-telecom-safe`: guter Standard fuer externe LLMs
 

docs/PRIVACY_SHARING.md

@@ -16,7 +16,7 @@ Related docs:
 
 | Scenario | Recommended profile | Notes |
 |---|---|---|
-| Internal team troubleshooting | `share` | Good default for most internal work |
+| Internal team troubleshooting | `share` | Good default for most internal work; endpoint and subscriber identifiers are pseudonymized |
 | Vendor ticket | `prod-safe` | Remove tokens, reduce sensitive metadata |
 | Lab replay / test environment | `lab` | Stronger anonymization, still useful context |
 | Personal local analysis | `internal` | Only in fully trusted environments |

docs/REFERENCE.md

@@ -753,7 +753,7 @@ For full details and supported types, see [`NETWORK_ELEMENT_DETECTION.md`](NETWO
 | Profile | What it does |
 |---|---|
 | `internal` | Keep everything as-is |
-| `share` | Pseudonymize subscriber IDs (IMSI, MSISDN), remove tokens |
+| `share` | Pseudonymize endpoints and subscriber IDs (IP, hostnames, IMSI, MSISDN), remove tokens |
 | `lab` | Pseudonymize all subscriber data, mask IPs |
 | `prod-safe` | Maximum protection — mask IPs, pseudonymize all PII, remove tokens/email/URI/payload |
 | `llm-telecom-safe` | External LLM-safe default — pseudonymize endpoints and subscriber IDs, remove secrets/payload, keep telecom structure |

pyproject.toml

@@ -41,6 +41,7 @@ Issues = "https://github.com/FrnkMrz/pcap2llm/issues"
 dev = [
   "pytest>=8.0",
   "ruff>=0.5",
+  "bandit>=1.7",
   "build>=1.2",
   "httpx>=0.28"
 ]

src/pcap2llm/privacy_profiles/share.yaml

@@ -3,8 +3,8 @@ description: >
   Safe for sharing with external parties or cross-team review.
   Subscriber identifiers are pseudonymized; tokens and bearer-text removed.
 modes:
-  ip: keep
-  hostname: keep
+  ip: pseudonymize
+  hostname: pseudonymize
   subscriber_id: pseudonymize
   msisdn: pseudonymize
   imsi: pseudonymize

src/pcap2llm/summarizer.py

@@ -45,39 +45,42 @@ def _detect_bursts(
 
     Returns a list of burst descriptors ``{start_ms, end_ms, packet_count}``.
     """
-    sorted_times = sorted(
+    times = [
         p["time_rel_ms"]
         for p in detail_packets
         if isinstance(p.get("time_rel_ms"), (int, float))
-    )
-    if len(sorted_times) < min_burst_size:
+    ]
+    if len(times) < min_burst_size:
         return []
 
     bursts: list[dict[str, Any]] = []
-    burst_start = sorted_times[0]
+    burst_start = times[0]
+    burst_end = times[0]
     burst_count = 1
 
-    for i in range(1, len(sorted_times)):
-        gap = sorted_times[i] - sorted_times[i - 1]
-        if gap <= threshold_ms:
+    for i in range(1, len(times)):
+        gap = times[i] - times[i - 1]
+        if 0 <= gap <= threshold_ms:
             burst_count += 1
+            burst_end = times[i]
         else:
             if burst_count >= min_burst_size:
                 bursts.append(
                     {
                         "start_ms": round(burst_start, 3),
-                        "end_ms": round(sorted_times[i - 1], 3),
+                        "end_ms": round(burst_end, 3),
                         "packet_count": burst_count,
                     }
                 )
-            burst_start = sorted_times[i]
+            burst_start = times[i]
+            burst_end = times[i]
             burst_count = 1
 
     if burst_count >= min_burst_size:
         bursts.append(
             {
                 "start_ms": round(burst_start, 3),
-                "end_ms": round(sorted_times[-1], 3),
+                "end_ms": round(burst_end, 3),
                 "packet_count": burst_count,
             }
         )

src/pcap2llm/web/app.py

@@ -242,7 +242,6 @@ async def show_job(request: Request, job_id: str) -> HTMLResponse:
             "downloads": store.list_download_entries(record),
             "log_sections": _collect_log_sections(store.logs_dir(job_id)),
             "flow_svg": _first_matching(store.artifacts_dir(job_id), ".svg"),
-            "flow_svg_markup": _read_flow_svg_markup(store.artifacts_dir(job_id)),
             "settings": settings,
             "analyze_defaults": analyze_defaults,
         }
@@ -305,6 +304,7 @@ async def run_analyze(
             local_support_defaults = _local_support_file_defaults(settings)
             hosts_path = await _resolve_support_file(
                 store=store,
+                settings=settings,
                 record=record,
                 label="hosts",
                 raw_path=hosts_file,
@@ -313,6 +313,7 @@ async def run_analyze(
             )
             mapping_path = await _resolve_support_file(
                 store=store,
+                settings=settings,
                 record=record,
                 label="mapping",
                 raw_path=mapping_file,
@@ -321,6 +322,7 @@ async def run_analyze(
             )
             subnets_path = await _resolve_support_file(
                 store=store,
+                settings=settings,
                 record=record,
                 label="subnets",
                 raw_path=subnets_file,
@@ -329,6 +331,7 @@ async def run_analyze(
             )
             ss7pcs_path = await _resolve_support_file(
                 store=store,
+                settings=settings,
                 record=record,
                 label="ss7pcs",
                 raw_path=ss7pcs_file,
@@ -337,6 +340,7 @@ async def run_analyze(
             )
             network_element_mapping_path = await _resolve_support_file(
                 store=store,
+                settings=settings,
                 record=record,
                 label="network-element-mapping",
                 raw_path=network_element_mapping_file,
@@ -931,6 +935,7 @@ def _parse_optional_float(value: str) -> float | None:
 async def _resolve_support_file(
     *,
     store: JobStore,
+    settings: WebSettings,
     record: JobRecord,
     label: str,
     raw_path: str,
@@ -954,13 +959,14 @@ async def _resolve_support_file(
     candidate = text or default_path
     if not candidate:
         return None
-    return str(_validate_support_path(candidate, store=store, record=record))
+    return str(_validate_support_path(candidate, store=store, settings=settings, record=record))
 
 
-def _validate_support_path(value: str, *, store: JobStore, record: JobRecord) -> Path:
+def _validate_support_path(value: str, *, store: JobStore, settings: WebSettings, record: JobRecord) -> Path:
     path = Path(value)
     resolved = path.resolve()
-    allowed_roots = (store.support_dir(record.job_id), store.workdir.parent / ".local", store.workdir.parent)
+    configured_root = settings.support_files_root or settings.local_workspace_dir
+    allowed_roots = (store.support_dir(record.job_id), configured_root)
     for root in allowed_roots:
         try:
             return ensure_within(root, resolved)
@@ -1064,20 +1070,6 @@ def _read_log(path: Path) -> str:
     return data[-8000:]
 
 
-def _read_flow_svg_markup(folder: Path) -> str | None:
-    filename = _first_matching(folder, ".svg")
-    if not filename:
-        return None
-    path = folder / filename
-    data = path.read_text(encoding="utf-8", errors="replace")
-    lowered = data.lower()
-    if not data.lstrip().startswith("<svg"):
-        return None
-    if "<script" in lowered or "javascript:" in lowered:
-        return None
-    return data
-
-
 def _collect_log_sections(logs_dir: Path) -> list[dict[str, str]]:
     sections: list[dict[str, str]] = []
     for prefix, label in (

src/pcap2llm/web/config.py

@@ -13,6 +13,7 @@ class WebSettings:
     max_upload_mb: int = 1
     command_timeout_seconds: int = 600
     tshark_path: str = ""
+    support_files_root: Path | None = None
     default_privacy_profile: str = "share"
     cleanup_enabled: bool = True
     cleanup_max_age_days: int = 7
@@ -47,6 +48,8 @@ def load_settings() -> WebSettings:
     max_upload_mb = int(os.getenv("PCAP2LLM_WEB_MAX_UPLOAD_MB", "1"))
     command_timeout_seconds = int(os.getenv("PCAP2LLM_WEB_COMMAND_TIMEOUT_SECONDS", "600"))
     tshark_path = os.getenv("PCAP2LLM_WEB_TSHARK_PATH", "")
+    support_files_root_env = os.getenv("PCAP2LLM_WEB_SUPPORT_FILES_ROOT", "")
+    support_files_root = Path(support_files_root_env) if support_files_root_env else None
     default_privacy_profile = os.getenv("PCAP2LLM_WEB_DEFAULT_PRIVACY_PROFILE", "share")
     cleanup_enabled = os.getenv("PCAP2LLM_WEB_CLEANUP_ENABLED", "true").lower() in ("true", "1", "yes")
     cleanup_max_age_days = int(os.getenv("PCAP2LLM_WEB_CLEANUP_MAX_AGE_DAYS", "7"))
@@ -58,6 +61,7 @@ def load_settings() -> WebSettings:
         max_upload_mb=max_upload_mb,
         command_timeout_seconds=command_timeout_seconds,
         tshark_path=tshark_path,
+        support_files_root=support_files_root,
         default_privacy_profile=default_privacy_profile,
         cleanup_enabled=cleanup_enabled,
         cleanup_max_age_days=cleanup_max_age_days,