Graham McIntire
9f45937a82
Some checks failed
Build and Push / Build and Push Docker Image (push) Failing after 2s
- Admin route authorization: all routes verified with dual protection, negative tests exist - Sobelow: regenerated .sobelow-skips (14 documented findings, no stale entries) - k8s: moved APRS_PASSWORD to APRS_PASSCODE secretKeyRef in deployment - Handoff document: marked remaining security items #4-6 as done
34 lines
1.9 KiB
Text
34 lines
1.9 KiB
Text
# Sobelow skip file — triaged 2026-07-26.
|
|
# All entries below are accepted false positives with documented rationale.
|
|
# Regenerate with: mix sobelow --mark-skip-all
|
|
|
|
# CSP is set dynamically via ContentSecurityPolicy plug. Sobelow cannot detect it.
|
|
Config.CSP: Missing Content-Security-Policy,lib/aprsme_web/router.ex:24,47E7962
|
|
|
|
# Traversal: seed_from_json reads hardcoded test fixture. No user input reaches this path.
|
|
Traversal.FileModule: Directory Traversal in `File.read`,lib/aprsme/devices_seeder.ex:8,1BF74FD
|
|
|
|
# SQL injection: quoted identifiers validated by regex + quote_identifier, no injection vector.
|
|
SQL.Query: SQL injection,lib/aprsme/partition_manager.ex:221,228A588
|
|
SQL.Query: SQL injection,lib/aprsme/partition_manager.ex:208,7DAAF2F
|
|
SQL.Query: SQL injection,lib/aprsme/partition_manager.ex:190,483C26
|
|
|
|
# SQL injection: timeout_seconds is div(milliseconds, 1000), an integer. Safe.
|
|
SQL.Query: SQL injection,lib/aprsme/release.ex:131,2F4FAB0
|
|
|
|
# XSS: Vendor heroicons SVG from priv/, name constrained to known icons — not user input.
|
|
XSS.Raw: XSS,lib/aprsme_web/components/core_components.ex:50,5E7AE1F
|
|
|
|
# Traversal: icon Path.join rooted in priv_dir. Not user-controllable.
|
|
Traversal.FileModule: Directory Traversal in `File.read`,lib/aprsme_web/components/core_components.ex:38,1721FC3
|
|
|
|
# XSS: style already escaped via Phoenix.HTML.html_escape() before raw() — safe double-unwrap pattern.
|
|
XSS.Raw: XSS,lib/aprsme_web/live/info_live/show.ex:554,1B04D86
|
|
XSS.Raw: XSS,lib/aprsme_web/live/info_live/show.ex:549,47D20CE
|
|
|
|
# SQL injection: queries use parameterized $1/$2 via Repo.query(query, [val, val]), not interpolation.
|
|
SQL.Query: SQL injection,lib/aprsme_web/live/info_live/show.ex:521,4DCE646
|
|
SQL.Query: SQL injection,lib/aprsme_web/live/info_live/show.ex:427,9779A6
|
|
|
|
# DOS: mix_unused is a compile-time dev tool. Not a runtime atom table vector.
|
|
DOS.StringToAtom: Unsafe `String.to_atom`,lib/mix_unused/analyzer.ex:99,1828283
|