fix(security): defense-in-depth hardening for plugin_maint#50
fix(security): defense-in-depth hardening for plugin_maint#50somethingwithproof wants to merge 5 commits into
Conversation
Automated fixes: - XSS: escape request variables in HTML value attributes - SQLi: convert string-concat queries to prepared statements - Deserialization: add allowed_classes=>false - Temp files: replace rand() with tempnam() Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
There was a problem hiding this comment.
Pull request overview
Defense-in-depth hardening for the maint Cacti plugin by reducing XSS risk in UI-generated forms and adding automated dependency update configuration.
Changes:
- Escapes
page/idrequest variables before rendering them into hidden form inputs inmaint.php. - Adds a Dependabot configuration to check for npm and GitHub Actions updates weekly.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| maint.php | Escapes request vars when output in hidden inputs to reduce XSS risk. |
| .github/dependabot.yml | Introduces Dependabot update schedules for npm and GitHub Actions. |
| - package-ecosystem: "npm" | ||
| directory: "/" | ||
| schedule: | ||
| interval: "weekly" | ||
| open-pull-requests-limit: 10 |
There was a problem hiding this comment.
The config enables the npm ecosystem at /, but the repository does not contain a package.json (or lockfile) in that directory. This will cause Dependabot update jobs to fail/no-op. Either remove the npm entry or point it at the directory that actually contains the npm manifests (and add them if intended).
| - package-ecosystem: "npm" | |
| directory: "/" | |
| schedule: | |
| interval: "weekly" | |
| open-pull-requests-limit: 10 |
- Change Dependabot ecosystem from npm to composer (PHP-only repo) - Remove PHP from CodeQL paths-ignore so security PRs get analysis - Remove committed .omc session artifacts, add .omc/ to .gitignore Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
|
Converted to draft to serialize the stack in this repo. Blocked by #49; will un-draft after that merges to avoid cross-PR merge conflicts. |
Summary
Defense-in-depth hardening addressing 24 security audit findings.
html_escape_request_var()allowed_classes => falsetounserialize()All changes PHP 7.0+ compatible.
Test plan