[cometvisu] Security fixes & cleanup for cometvisu backend #2671
Conversation
wrong backup/trash file creation Signed-off-by: Tobias Bräutigam <[email protected]>
Signed-off-by: Tobias Bräutigam <[email protected]>
user folder. closes GHSA-pcwp-26pw-j98w Signed-off-by: Tobias Bräutigam <[email protected]>
Signed-off-by: Tobias Bräutigam <[email protected]>
Signed-off-by: Tobias Bräutigam <[email protected]>
Signed-off-by: Tobias Bräutigam <[email protected]>
Signed-off-by: Tobias Bräutigam <[email protected]>
check if the file has been delivered by openHAB Signed-off-by: Tobias Bräutigam <[email protected]>
remove handling of old hidden file syntax improve written code Signed-off-by: Tobias Bräutigam <[email protected]>
errors to the definition Signed-off-by: Tobias Bräutigam <[email protected]>
peuter
changed the title
|
Thanks for the security fixed @peuter - do you mind taking a look at the code scanning results for CometVisu? |
|
I will take a look at the code scanning results, will take some time because there are quite a lot of them. I just randomly looked into some of them and they looked like false positives (or negatives regarding the topic ;-) to me. All the "uncontrolled data used in path expression" do not seem to recognize that there is a path check in MountedFile. But I will check that with a little bit more time than I have right now. Maybe I am missing something. |
|
Code scanning results for Vue/JS also had some false positives, but overall it caught a few things really well. |
|
@peuter Just in case you again didn't receive any notification - could you please have a look at the feedback at https://github.com/openhab/openhab-webui/security/advisories/GHSA-v7gr-mqpj-wwh3#advisory-comment-106507 and respond to it? As soon as everything is clarified, I would like to backport the fix(es) to 4.1.x and publish the advisories. Thanks! |
|
No I haven't been noticed, I dont know why I do not get noticed when I am mentioned in the advisories, I checked all settings I could find in github. Anyways I will check them soon. |
) add required authentication for some rest endpoints, add some sanity checks to improve security. Remove code that has been marked as deprecated. --------- Signed-off-by: Tobias Bräutigam <[email protected]>
kaikreuzer
added
the
patch
|
Cherry-picked to |
|
@peuter Did you find the time to look into the remaining file separator issue? |
add required authentication for some rest endpoints, add some sanity checks to improve security.
Remove code that has been marked as deprecated.