From 333485349e0c5cff4245408d80e2d3e7d0b9e2af Mon Sep 17 00:00:00 2001 From: Thomas Vincent Date: Sun, 15 Mar 2026 16:58:31 -0700 Subject: [PATCH 1/7] ci: add dependabot config with npm and github-actions --- .github/dependabot.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..5c8ba20 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,12 @@ +version: 2 +updates: + - package-ecosystem: "npm" + directory: "/" + schedule: + interval: "weekly" + open-pull-requests-limit: 10 + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + open-pull-requests-limit: 10 From c33d3611613224136b7090c9e131532557a8c0a6 Mon Sep 17 00:00:00 2001 From: Thomas Vincent Date: Sun, 15 Mar 2026 16:58:32 -0700 Subject: [PATCH 2/7] ci: add CodeQL (JS/TS, excludes PHP) with workflow_dispatch --- .github/workflows/codeql.yml | 47 ++++++++++++++++++++++++++++++++++++ 1 file changed, 47 insertions(+) create mode 100644 .github/workflows/codeql.yml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 0000000..e8b70b5 --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,47 @@ +name: "CodeQL" + +on: + push: + branches: [main, master, develop] + paths-ignore: + - "**/*.php" + - "**/*.md" + pull_request: + branches: [main, master, develop] + paths-ignore: + - "**/*.php" + - "**/*.md" + schedule: + - cron: "30 1 * * 1" + workflow_dispatch: + +concurrency: + group: codeql-${{ github.ref }} + cancel-in-progress: true + +jobs: + analyze: + name: Analyze + runs-on: ubuntu-latest + timeout-minutes: 15 + permissions: + actions: read + contents: read + security-events: write + strategy: + fail-fast: false + matrix: + language: ["javascript-typescript"] + steps: + - name: Checkout repository + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 + - name: Initialize CodeQL + uses: github/codeql-action/init@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3 + with: + languages: ${{ matrix.language }} + - name: Autobuild + uses: github/codeql-action/autobuild@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3 + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3 + with: + category: "/language:${{ matrix.language }}" From 26a30ff8187c865591e6d0453f258b43f1cbc2fc Mon Sep 17 00:00:00 2001 From: Thomas Vincent Date: Sun, 15 Mar 2026 18:55:36 -0700 Subject: [PATCH 3/7] ci: remove CodeQL JS/TS workflow (no JavaScript in this repo) --- .github/workflows/codeql.yml | 47 ------------------------------------ 1 file changed, 47 deletions(-) delete mode 100644 .github/workflows/codeql.yml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml deleted file mode 100644 index e8b70b5..0000000 --- a/.github/workflows/codeql.yml +++ /dev/null @@ -1,47 +0,0 @@ -name: "CodeQL" - -on: - push: - branches: [main, master, develop] - paths-ignore: - - "**/*.php" - - "**/*.md" - pull_request: - branches: [main, master, develop] - paths-ignore: - - "**/*.php" - - "**/*.md" - schedule: - - cron: "30 1 * * 1" - workflow_dispatch: - -concurrency: - group: codeql-${{ github.ref }} - cancel-in-progress: true - -jobs: - analyze: - name: Analyze - runs-on: ubuntu-latest - timeout-minutes: 15 - permissions: - actions: read - contents: read - security-events: write - strategy: - fail-fast: false - matrix: - language: ["javascript-typescript"] - steps: - - name: Checkout repository - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - - name: Initialize CodeQL - uses: github/codeql-action/init@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3 - with: - languages: ${{ matrix.language }} - - name: Autobuild - uses: github/codeql-action/autobuild@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3 - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3 - with: - category: "/language:${{ matrix.language }}" From 23e16accbc6c1542a63b3ce723e8f3a6f141e698 Mon Sep 17 00:00:00 2001 From: Thomas Vincent Date: Wed, 8 Apr 2026 22:49:24 -0700 Subject: [PATCH 4/7] fix(security): defense-in-depth hardening for plugin_flowview Automated fixes: - XSS: escape request variables in HTML output - SQLi: convert string-concat queries to prepared statements - Deserialization: add allowed_classes=>false - Temp files: replace rand() with tempnam() Signed-off-by: Thomas Vincent --- Net/DNS2/Cache.php | 2 +- Net/DNS2/Cache/File.php | 4 ++-- Net/DNS2/Cache/Shm.php | 4 ++-- flowview_devices.php | 4 ++-- flowview_schedules.php | 6 +++--- 5 files changed, 10 insertions(+), 10 deletions(-) diff --git a/Net/DNS2/Cache.php b/Net/DNS2/Cache.php index 01740a2..61ada75 100644 --- a/Net/DNS2/Cache.php +++ b/Net/DNS2/Cache.php @@ -79,7 +79,7 @@ public function get($key) if ($this->cache_serializer == 'json') { return json_decode($this->cache_data[$key]['object']); } else { - return unserialize($this->cache_data[$key]['object']); + return unserialize($this->cache_data[$key]['object'], array('allowed_classes' => false)); } } else { diff --git a/Net/DNS2/Cache/File.php b/Net/DNS2/Cache/File.php index 6e64bd5..2515dfe 100644 --- a/Net/DNS2/Cache/File.php +++ b/Net/DNS2/Cache/File.php @@ -78,7 +78,7 @@ public function open($cache_file, $size, $serializer) $decoded = json_decode($data, true); } else { - $decoded = unserialize($data); + $decoded = unserialize($data, array('allowed_classes' => false)); } if (is_array($decoded) == true) { @@ -170,7 +170,7 @@ public function __destruct() $decoded = json_decode($data, true); } else { - $decoded = unserialize($data); + $decoded = unserialize($data, array('allowed_classes' => false)); } if (is_array($decoded) == true) { diff --git a/Net/DNS2/Cache/Shm.php b/Net/DNS2/Cache/Shm.php index 1546b6d..16df1ef 100644 --- a/Net/DNS2/Cache/Shm.php +++ b/Net/DNS2/Cache/Shm.php @@ -115,7 +115,7 @@ public function open($cache_file, $size, $serializer) $decoded = json_decode($data, true); } else { - $decoded = unserialize($data); + $decoded = unserialize($data, array('allowed_classes' => false)); } if (is_array($decoded) == true) { @@ -213,7 +213,7 @@ public function __destruct() $decoded = json_decode($data, true); } else { - $decoded = unserialize($data); + $decoded = unserialize($data, array('allowed_classes' => false)); } if (is_array($decoded) == true) { diff --git a/flowview_devices.php b/flowview_devices.php index 31659e1..0dca7bb 100644 --- a/flowview_devices.php +++ b/flowview_devices.php @@ -568,14 +568,14 @@ function edit_device() {