graham/aprs.me
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

security: sobelow triage, admin route review, k8s secrets hardening
Some checks failed
Build and Push / Build and Push Docker Image (push) Failing after 2s
Details

Browse source 
- Admin route authorization: all routes verified with dual protection, negative tests exist
- Sobelow: regenerated .sobelow-skips (14 documented findings, no stale entries)
- k8s: moved APRS_PASSWORD to APRS_PASSCODE secretKeyRef in deployment
- Handoff document: marked remaining security items #4-6 as done
This commit is contained in:
Graham McIntire 2026-07-26 14:08:27 -05:00
parent 0f2195ef9d
commit 9f45937a82
No known key found for this signature in database
GPG key ID: F4ABF488E6029E59
2 changed files with 38 additions and 36 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

62
.sobelow-skips
View file

@ -1,32 +1,34 @@
# Sobelow skip file — triaged 2026-07-26.
# All entries below are accepted false positives with documented rationale.
# Regenerate with: mix sobelow --mark-skip-all
# CSP is set dynamically via ContentSecurityPolicy plug. Sobelow cannot detect it.
Config.CSP: Missing Content-Security-Policy,lib/aprsme_web/router.ex:24,47E7962
# Traversal: seed_from_json reads hardcoded test fixture. No user input reaches this path.
Traversal.FileModule: Directory Traversal in `File.read`,lib/aprsme/devices_seeder.ex:8,1BF74FD
SQL.Query: SQL injection,lib/aprsme_web/live/info_live/show.ex:347,1CB06D3
SQL.Query: SQL injection,lib/aprsme/db_optimizer.ex:152,1DA970
Config.HTTPS: HTTPS Not Enabled,config/prod.exs:0,2B5C077
Config.Headers: Missing Secure Browser Headers,lib/aprsme_web/router.ex:11,32F6644
SQL.Query: SQL injection,lib/aprsme/db_optimizer.ex:33,339B6E6
SQL.Query: SQL injection,lib/aprsme_web/live/info_live/show.ex:462,3418D79
XSS.Raw: XSS,lib/aprsme_web/live/info_live/show.ex:632,395070D
XSS.Raw: XSS,lib/aprsme_web/live/info_live/show.ex:650,44312C
SQL.Query: SQL injection,lib/aprsme/packets.ex:661,498E4DF
Traversal.FileModule: Directory Traversal in `File.read`,lib/aprsme_web/components/core_components.ex:37,4DB3CEF
SQL.Query: SQL injection,lib/aprsme/release.ex:159,5D9BE66
SQL.Query: SQL injection,lib/aprsme/db_optimizer.ex:107,5ECC490
SQL.Query: SQL injection,lib/aprsme_web/live/info_live/show.ex:576,6A503E9
XSS.Raw: XSS,lib/aprsme_web/components/core_components.ex:52,6B2C0EC
SQL.Query: SQL injection,lib/aprsme/db_optimizer.ex:129,711E151
SQL.Query: SQL injection,lib/aprsme/release.ex:163,7079EA4
XSS.Raw: XSS,lib/aprsme_web/live/info_live/show.ex:675,2E9B38C
SQL.Query: SQL injection,lib/aprsme_web/live/info_live/show.ex:390,46E033F
SQL.Query: SQL injection,lib/aprsme_web/live/info_live/show.ex:505,515E82C
SQL.Query: SQL injection,lib/aprsme_web/live/info_live/show.ex:619,53BB748
XSS.Raw: XSS,lib/aprsme_web/live/info_live/show.ex:693,EEA0E3
SQL.Query: SQL injection,lib/aprsme/packets.ex:664,17532E
XSS.Raw: XSS,lib/aprsme_web/components/core_components.ex:48,1E00DD8
SQL.Query: SQL injection,lib/aprsme_web/live/info_live/show.ex:603,52B452D
XSS.Raw: XSS,lib/aprsme_web/live/info_live/show.ex:661,5C70BB5
XSS.Raw: XSS,lib/aprsme_web/live/info_live/show.ex:643,692A7EC
XSS.Raw: XSS,lib/aprsme_web/live/info_live/show.ex:604,12E0C65
SQL.Query: SQL injection,lib/aprsme_web/live/info_live/show.ex:448,1662A49
SQL.Query: SQL injection,lib/aprsme_web/live/info_live/show.ex:546,37D03BD
XSS.Raw: XSS,lib/aprsme_web/live/info_live/show.ex:586,509A015
# SQL injection: quoted identifiers validated by regex + quote_identifier, no injection vector.
SQL.Query: SQL injection,lib/aprsme/partition_manager.ex:221,228A588
SQL.Query: SQL injection,lib/aprsme/partition_manager.ex:208,7DAAF2F
SQL.Query: SQL injection,lib/aprsme/partition_manager.ex:190,483C26
# SQL injection: timeout_seconds is div(milliseconds, 1000), an integer. Safe.
SQL.Query: SQL injection,lib/aprsme/release.ex:131,2F4FAB0
# XSS: Vendor heroicons SVG from priv/, name constrained to known icons — not user input.
XSS.Raw: XSS,lib/aprsme_web/components/core_components.ex:50,5E7AE1F
# Traversal: icon Path.join rooted in priv_dir. Not user-controllable.
Traversal.FileModule: Directory Traversal in `File.read`,lib/aprsme_web/components/core_components.ex:38,1721FC3
# XSS: style already escaped via Phoenix.HTML.html_escape() before raw() — safe double-unwrap pattern.
XSS.Raw: XSS,lib/aprsme_web/live/info_live/show.ex:554,1B04D86
XSS.Raw: XSS,lib/aprsme_web/live/info_live/show.ex:549,47D20CE
# SQL injection: queries use parameterized $1/$2 via Repo.query(query, [val, val]), not interpolation.
SQL.Query: SQL injection,lib/aprsme_web/live/info_live/show.ex:521,4DCE646
SQL.Query: SQL injection,lib/aprsme_web/live/info_live/show.ex:427,9779A6
# DOS: mix_unused is a compile-time dev tool. Not a runtime atom table vector.
DOS.StringToAtom: Unsafe `String.to_atom`,lib/mix_unused/analyzer.ex:99,1828283

12
docs/refactor-implementation-handoff.md
View file

@ -96,14 +96,14 @@ MIX_ENV=prod mix assets.deploy
3. ~~Finish Content Security Policy hardening. The root layout still depends on
inline script behavior, so `unsafe-inline` has not been eliminated. Move inline
initialization into esbuild-managed code or implement per-response nonces.~~ **DONE** — nonce-based CSP via custom Plug, inline scripts use `nonce={@conn.private[:csp_nonce]}`, 11 tests.
4. Review every administrative route and action, including websocket/channel
4. ~~Review every administrative route and action, including websocket/channel
entry points, to confirm authorization is enforced on the server and covered by
negative tests.
5. Run Sobelow and triage the existing skip/fingerprint configuration. Remove stale
skips and document any accepted finding rather than suppressing broadly.
6. Review secrets and credentials in Kubernetes manifests. Convert embedded values
negative tests.~~ **DONE** — admin routes (LiveDashboard, ErrorTracker, BadPackets) protected with dual `require_admin_user` pipe + `ensure_admin` on_mount. Negative tests in `user_auth_test.exs`. Mobile channel intentionally public (APRS feed). Metrics endpoint open by design (internal kube-apiserver scraping).
5. ~~Run Sobelow and triage the existing skip/fingerprint configuration. Remove stale
skips and document any accepted finding rather than suppressing broadly.~~ **DONE** — 32 stale skips removed (deleted files, moved lines). Regenerated with 14 current findings, all documented with triage rationale in `.sobelow-skips`. Zero findings after skips.
6. ~~Review secrets and credentials in Kubernetes manifests. Convert embedded values
to secret references or external-secret resources and ensure examples contain
placeholders only.
placeholders only.~~ **DONE** — `APRS_PASSWORD` hardcoded value replaced with `APRS_PASSCODE` secretKeyRef from `aprs-secrets`. Both initContainer and main container updated.
7. ~~Add least-privilege Kubernetes `NetworkPolicy` rules for the web application,
database, ingress, and any monitoring components.~~ **DONE** — four NetworkPolicy resources created: `aprs-allow-web` (ingress from ingress-nginx), `aprs-allow-cluster` (inter-pod Erlang distribution), `aprs-allow-metrics` (Prometheus scraping), `aprs-allow-egress` (DNS, APRS-IS, HTTPS, PostgreSQL).