🚨 Severity: MEDIUM
💡 Vulnerability: Information Exposure (CWE-209)
- The web dashboard returned raw exception messages to users, potentially leaking internal details (stack traces, file paths, sensitive info).
- This violated the principle of "Fail Securely".
🎯 Impact:
- Attackers could glean information about the internal file structure or database errors to facilitate further attacks.
🔧 Fix:
- Configured `logging` to capture errors securely to stderr (standard practice for containerized apps).
- Updated `dashboard()` and `get_cached_markdown` to log the full exception traceback server-side.
- Changed user-facing response to a generic "Internal Server Error" (500).
✅ Verification:
- Added unit test `test_dashboard_error_handling` in `scripts/test_web_dashboard.py`.
- Verified that the test passes: `python scripts/test_web_dashboard.py`.
- Confirmed that the response body contains "Internal Server Error" and does NOT contain the mock secret.
- Replaced #667eea with #4f46e5 to meet WCAG AA contrast standards.
- Updated hover color to #4338ca.
- Added aria-label to Service Worker update button.
- Updated manifest.json theme color.
- Added daisy.ns.cloudflare.com and rocco.ns.cloudflare.com to Cloudflare guide.
- Unified domain name to lengkundee01.org in CNAME and PWA guide.
- Verified active domain using dig.
- Updated sentinel journal with documentation learnings.
- Modified `scripts/review_pull_requests.py` to filter `git for-each-ref` output by unmerged branches.
- Reduces algorithmic complexity from O(N) to O(M) where N is total branches and M is active branches.
- Avoids expensive `ahead-behind` calculations for potentially thousands of stale merged branches.
- Changed `check_authorized` in `scripts/telegram_deploy_bot.py` to fail closed (deny all) if `TELEGRAM_ALLOWED_USER_IDS` is unset or empty.
- Updated `scripts/TELEGRAM_BOT_SETUP.md` and `QUICK_DEPLOY.md` to document that `TELEGRAM_ALLOWED_USER_IDS` is now mandatory for bot access.
- Added Sentinel Journal entry in `.jules/sentinel.md` documenting the vulnerability and learning.
- Verified fix with reproduction script.
Replaced `os.path.exists()` + `os.path.getmtime()` with a single `os.stat()` call in `scripts/web_dashboard.py` to reduce syscalls by 50% for cache checks. Also pre-calculated static file paths at module level to avoid redundant `abspath` and `join` calls on every request.
Impact:
- Reduces filesystem operations per request.
- Improves code cleanliness by centralizing path constants.
- Verified with existing tests and manual curl check.
This commit corrects a subtle off-by-one error in the array boundary check for the Donchian channel lookback period.
The original condition `if(donStart + donCount >= needBars)` would incorrectly cause an early exit if the required number of bars for the lookback precisely matched the number of available bars in the array. This prevented valid signals from being processed at the edge of the dataset.
The condition has been changed to `if(donStart + donCount > needBars)`, which is the correct boundary check. This ensures the calculation proceeds when exactly enough data is available and only exits if there is insufficient data, improving the EA's robustness.
This issue was identified during a code review for a separate performance optimization attempt.
Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
Implements a caching mechanism for the multi-timeframe (MTF) trend confirmation in `GetMTFDir`.
The trend direction from the lower timeframe is now calculated only when a new bar forms on that timeframe, instead of on every tick of the main chart. The result is cached and returned on subsequent calls until the next lower timeframe bar appears.
This avoids expensive and redundant `CopyBuffer` calls, significantly improving the EA's performance and efficiency, especially when the signal timeframe is much shorter than the confirmation timeframe. Logic was carefully updated to read from the last *completed* bar to prevent any change in trading behavior.
