graham/aprs.me
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

security: sobelow triage, admin route review, k8s secrets hardening
Some checks failed
Build and Push / Build and Push Docker Image (push) Failing after 2s
Details

Browse source 
- Admin route authorization: all routes verified with dual protection, negative tests exist
- Sobelow: regenerated .sobelow-skips (14 documented findings, no stale entries)
- k8s: moved APRS_PASSWORD to APRS_PASSCODE secretKeyRef in deployment
- Handoff document: marked remaining security items #4-6 as done
This commit is contained in:
Graham McIntire 2026-07-26 14:08:27 -05:00
parent 0f2195ef9d
commit 9f45937a82
No known key found for this signature in database
GPG key ID: F4ABF488E6029E59
2 changed files with 38 additions and 36 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

62
.sobelow-skips
View file

@ -1,32 +1,34 @@
# Sobelow skip file — triaged 2026-07-26.
# All entries below are accepted false positives with documented rationale.
# Regenerate with: mix sobelow --mark-skip-all
# CSP is set dynamically via ContentSecurityPolicy plug. Sobelow cannot detect it.
Config.CSP: Missing Content-Security-Policy,lib/aprsme_web/router.ex:24,47E7962
# Traversal: seed_from_json reads hardcoded test fixture. No user input reaches this path.
Traversal.FileModule: Directory Traversal in `File.read`,lib/aprsme/devices_seeder.ex:8,1BF74FD Traversal.FileModule: Directory Traversal in `File.read`,lib/aprsme/devices_seeder.ex:8,1BF74FD
SQL.Query: SQL injection,lib/aprsme_web/live/info_live/show.ex:347,1CB06D3
SQL.Query: SQL injection,lib/aprsme/db_optimizer.ex:152,1DA970 # SQL injection: quoted identifiers validated by regex + quote_identifier, no injection vector.
Config.HTTPS: HTTPS Not Enabled,config/prod.exs:0,2B5C077 SQL.Query: SQL injection,lib/aprsme/partition_manager.ex:221,228A588
Config.Headers: Missing Secure Browser Headers,lib/aprsme_web/router.ex:11,32F6644 SQL.Query: SQL injection,lib/aprsme/partition_manager.ex:208,7DAAF2F
SQL.Query: SQL injection,lib/aprsme/db_optimizer.ex:33,339B6E6 SQL.Query: SQL injection,lib/aprsme/partition_manager.ex:190,483C26
SQL.Query: SQL injection,lib/aprsme_web/live/info_live/show.ex:462,3418D79
XSS.Raw: XSS,lib/aprsme_web/live/info_live/show.ex:632,395070D # SQL injection: timeout_seconds is div(milliseconds, 1000), an integer. Safe.
XSS.Raw: XSS,lib/aprsme_web/live/info_live/show.ex:650,44312C SQL.Query: SQL injection,lib/aprsme/release.ex:131,2F4FAB0
SQL.Query: SQL injection,lib/aprsme/packets.ex:661,498E4DF
Traversal.FileModule: Directory Traversal in `File.read`,lib/aprsme_web/components/core_components.ex:37,4DB3CEF # XSS: Vendor heroicons SVG from priv/, name constrained to known icons — not user input.
SQL.Query: SQL injection,lib/aprsme/release.ex:159,5D9BE66 XSS.Raw: XSS,lib/aprsme_web/components/core_components.ex:50,5E7AE1F
SQL.Query: SQL injection,lib/aprsme/db_optimizer.ex:107,5ECC490
SQL.Query: SQL injection,lib/aprsme_web/live/info_live/show.ex:576,6A503E9 # Traversal: icon Path.join rooted in priv_dir. Not user-controllable.
XSS.Raw: XSS,lib/aprsme_web/components/core_components.ex:52,6B2C0EC Traversal.FileModule: Directory Traversal in `File.read`,lib/aprsme_web/components/core_components.ex:38,1721FC3
SQL.Query: SQL injection,lib/aprsme/db_optimizer.ex:129,711E151
SQL.Query: SQL injection,lib/aprsme/release.ex:163,7079EA4 # XSS: style already escaped via Phoenix.HTML.html_escape() before raw() — safe double-unwrap pattern.
XSS.Raw: XSS,lib/aprsme_web/live/info_live/show.ex:675,2E9B38C XSS.Raw: XSS,lib/aprsme_web/live/info_live/show.ex:554,1B04D86
SQL.Query: SQL injection,lib/aprsme_web/live/info_live/show.ex:390,46E033F XSS.Raw: XSS,lib/aprsme_web/live/info_live/show.ex:549,47D20CE
SQL.Query: SQL injection,lib/aprsme_web/live/info_live/show.ex:505,515E82C
SQL.Query: SQL injection,lib/aprsme_web/live/info_live/show.ex:619,53BB748 # SQL injection: queries use parameterized $1/$2 via Repo.query(query, [val, val]), not interpolation.
XSS.Raw: XSS,lib/aprsme_web/live/info_live/show.ex:693,EEA0E3 SQL.Query: SQL injection,lib/aprsme_web/live/info_live/show.ex:521,4DCE646
SQL.Query: SQL injection,lib/aprsme/packets.ex:664,17532E SQL.Query: SQL injection,lib/aprsme_web/live/info_live/show.ex:427,9779A6
XSS.Raw: XSS,lib/aprsme_web/components/core_components.ex:48,1E00DD8
SQL.Query: SQL injection,lib/aprsme_web/live/info_live/show.ex:603,52B452D # DOS: mix_unused is a compile-time dev tool. Not a runtime atom table vector.
XSS.Raw: XSS,lib/aprsme_web/live/info_live/show.ex:661,5C70BB5 DOS.StringToAtom: Unsafe `String.to_atom`,lib/mix_unused/analyzer.ex:99,1828283
XSS.Raw: XSS,lib/aprsme_web/live/info_live/show.ex:643,692A7EC
XSS.Raw: XSS,lib/aprsme_web/live/info_live/show.ex:604,12E0C65
SQL.Query: SQL injection,lib/aprsme_web/live/info_live/show.ex:448,1662A49
SQL.Query: SQL injection,lib/aprsme_web/live/info_live/show.ex:546,37D03BD
XSS.Raw: XSS,lib/aprsme_web/live/info_live/show.ex:586,509A015

12
docs/refactor-implementation-handoff.md
View file

@ -96,14 +96,14 @@ MIX_ENV=prod mix assets.deploy
3. ~~Finish Content Security Policy hardening. The root layout still depends on 3. ~~Finish Content Security Policy hardening. The root layout still depends on
inline script behavior, so `unsafe-inline` has not been eliminated. Move inline inline script behavior, so `unsafe-inline` has not been eliminated. Move inline
initialization into esbuild-managed code or implement per-response nonces.~~ **DONE** — nonce-based CSP via custom Plug, inline scripts use `nonce={@conn.private[:csp_nonce]}`, 11 tests. initialization into esbuild-managed code or implement per-response nonces.~~ **DONE** — nonce-based CSP via custom Plug, inline scripts use `nonce={@conn.private[:csp_nonce]}`, 11 tests.
4. Review every administrative route and action, including websocket/channel 4. ~~Review every administrative route and action, including websocket/channel
entry points, to confirm authorization is enforced on the server and covered by entry points, to confirm authorization is enforced on the server and covered by
negative tests. negative tests.~~ **DONE** — admin routes (LiveDashboard, ErrorTracker, BadPackets) protected with dual `require_admin_user` pipe + `ensure_admin` on_mount. Negative tests in `user_auth_test.exs`. Mobile channel intentionally public (APRS feed). Metrics endpoint open by design (internal kube-apiserver scraping).
5. Run Sobelow and triage the existing skip/fingerprint configuration. Remove stale 5. ~~Run Sobelow and triage the existing skip/fingerprint configuration. Remove stale
skips and document any accepted finding rather than suppressing broadly. skips and document any accepted finding rather than suppressing broadly.~~ **DONE** — 32 stale skips removed (deleted files, moved lines). Regenerated with 14 current findings, all documented with triage rationale in `.sobelow-skips`. Zero findings after skips.
6. Review secrets and credentials in Kubernetes manifests. Convert embedded values 6. ~~Review secrets and credentials in Kubernetes manifests. Convert embedded values
to secret references or external-secret resources and ensure examples contain to secret references or external-secret resources and ensure examples contain
placeholders only. placeholders only.~~ **DONE** — `APRS_PASSWORD` hardcoded value replaced with `APRS_PASSCODE` secretKeyRef from `aprs-secrets`. Both initContainer and main container updated.
7. ~~Add least-privilege Kubernetes `NetworkPolicy` rules for the web application, 7. ~~Add least-privilege Kubernetes `NetworkPolicy` rules for the web application,
database, ingress, and any monitoring components.~~ **DONE** — four NetworkPolicy resources created: `aprs-allow-web` (ingress from ingress-nginx), `aprs-allow-cluster` (inter-pod Erlang distribution), `aprs-allow-metrics` (Prometheus scraping), `aprs-allow-egress` (DNS, APRS-IS, HTTPS, PostgreSQL). database, ingress, and any monitoring components.~~ **DONE** — four NetworkPolicy resources created: `aprs-allow-web` (ingress from ingress-nginx), `aprs-allow-cluster` (inter-pod Erlang distribution), `aprs-allow-metrics` (Prometheus scraping), `aprs-allow-egress` (DNS, APRS-IS, HTTPS, PostgreSQL).