fix(security): resolve real CodeQL findings + upgrade vulnerable frontend deps#12
Merged
Conversation
…tend deps Triaged all CodeQL + Dependabot alerts against the code; fixes the genuine ones, hardens one, and upgrades vulnerable deps. (Verified false-positives — backup extractor, kv alloc clamp, API-key SHA256, OAuth redirect_uri validation, logout deletion cookie — are left as-is and will be dismissed with reasons.) - path-injection (functions.go rollback, builder/activate.go): code_hash from the request body flowed into a versions/<hash> filesystem path. Validate it is a 64-char lowercase-hex sha256 (its only legitimate shape) before use; defensive re-check in ActivateVersion. + builder/activate_test.go. - zipslip (builder.go extractTarGz): add the joined-path-under-destDir guard the backup extractor already uses (defense-in-depth; deploy tarballs). - biased-random (Onboarding.vue): replace `crypto % n` in the password generator + Fisher-Yates shuffle with unbiased rejection sampling. - CI: add least-privilege `permissions: contents: read` to cli-e2e/e2e/install-e2e workflows (clears 10 actions/missing-workflow-permissions). - deps: bump axios 1.15→1.17 + npm audit fix (follow-redirects, postcss); `npm audit` now reports 0 vulnerabilities. Supersedes Dependabot PR #11. go build/vet/test green; npm audit 0; ui rebuilt + re-embedded.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolves the GitHub CodeQL + Dependabot findings. Every alert was triaged against the actual code; this PR fixes the genuine ones, hardens one, and upgrades vulnerable frontend deps. The verified false-positives / by-design alerts are intentionally left as code and will be dismissed with documented reasons (see below).
Real fixes
functions.gorollback +builder/activate.go):code_hashfrom the request body flowed into aversions/<hash>filesystem path. Now validated as a 64-char lowercase-hex sha256 (its only legitimate shape) before use, with a defensive re-check inActivateVersion. +activate_test.go.builder.goextractTarGz): added the joined-path-under-destDir guard the backup extractor already uses (defense-in-depth for deploy tarballs).Onboarding.vue): replacedcrypto % nin the password generator + Fisher–Yates shuffle with unbiased rejection sampling.permissions: contents: readadded tocli-e2e/e2e/install-e2eworkflows → clears 10actions/missing-workflow-permissions.1.15 → 1.17+npm audit fix(follow-redirects, postcss) →npm auditreports 0. Supersedes Dependabot PR chore(deps): bump axios from 1.15.0 to 1.16.0 in /frontend #11.Dismiss-as-noise (no code change — done post-merge with reasons)
backup.go zipslip + path-injection (extractor sanitizes), kv.go alloc (
limitclamped ≤1000), API-key SHA256 ×2 (256-bit random token; correct), OAuth redirect ×2 (redirect_urivalidated), logout cookie Secure (deletion cookie; issuers set it conditionally).Validation
go build/vet/test -racegreen (+ newactivate_test.gofor the hash guard).npm audit= 0;npm run build+make embed.No release — main stays ready.