From d9afb6a3e44812de31c86a63bbb6ec3049cc4012 Mon Sep 17 00:00:00 2001 From: Graham McIntire Date: Tue, 12 May 2026 11:27:32 -0500 Subject: [PATCH] remove fixed bugs (H12, L2, L5, L6, L8, L10, L11) from bugs.md --- bugs.md | 85 --------------------------------------------------------- 1 file changed, 85 deletions(-) diff --git a/bugs.md b/bugs.md index f94934d6..f9320511 100644 --- a/bugs.md +++ b/bugs.md @@ -43,19 +43,6 @@ --- -### H12. Missing `Secure` and `HttpOnly` on Session Cookie - -**File:** `lib/towerops_web/endpoint.ex:8-14` -**File:** `lib/towerops/user_auth.ex:29-33` (remember-me cookie) - -**Severity:** HIGH — Session cookie sent over HTTP; accessible via JS - -**Description:** `@session_options` has `same_site: "Lax"` but no `secure: true` or `http_only: true`. Session cookie transmitted in cleartext over HTTP and accessible via `document.cookie`. - -**Fix:** Add `secure: true, http_only: true` to both session and remember-me cookie configs. - ---- - ### H13. PromEx Metrics Server Unauthenticated **File:** `config/config.exs:106-117` @@ -437,18 +424,6 @@ --- -### L2. 404 Tracker EXPIRE Without NX Flag - -**File:** `lib/towerops/security/four_oh_four_tracker.ex:32` - -**Severity:** LOW — Attacker can extend tracking window indefinitely - -**Description:** `EXPIRE` called on every 404 regardless of whether key already exists. NO `NX` option means each hit refreshes the TTL. - -**Fix:** Use `EXPIRE key 60 NX` to only set expiry on first creation. - ---- - ### L3. IPv4-Mapped IPv6 Not Handled in Whitelist **File:** `lib/towerops/security/brute_force.ex:36-49` @@ -473,30 +448,6 @@ --- -### L5. Vault Initialization Reads Prod Key in Dev - -**File:** `lib/towerops/vault.ex:29` - -**Severity:** LOW — If `CLOAK_KEY` env var is set, dev uses production encryption key - -**Description:** `if System.get_env("CLOAK_KEY") do` — no environment guard. A developer with prod env set will use the production key in dev. - -**Fix:** Only read `CLOAK_KEY` in production, or use a separate `CLOAK_KEY_DEV`. - ---- - -### L6. Health Endpoint Leaks App Version - -**File:** `lib/towerops_web/controllers/health_controller.ex:29` - -**Severity:** LOW — Helps attackers identify vulnerable versions - -**Description:** `Application.spec(:towerops, :vsn)` returned publicly. - -**Fix:** Remove version from public health endpoint. - ---- - ### L7. Device Capacity Operations Missing Org Scoping **File:** `lib/towerops_web/live/device_live/show.ex:728-757` @@ -509,18 +460,6 @@ --- -### L8. Insights Dismiss Missing Org Scope - -**File:** `lib/towerops_web/live/insights_live/index.ex:71-82` - -**Severity:** LOW — IDOR on dismiss, but low impact (read-only dismissal) - -**Description:** `Preseem.dismiss_insight(id)` with no org scope check. - -**Fix:** Verify org ownership before dismissing. - ---- - ### L9. Duplicate Pattern in Sync Workers **Files:** `gaiia_sync_worker.ex`, `sonar_sync_worker.ex`, `splynx_sync_worker.ex`, `visp_sync_worker.ex`, `netbox_sync_worker.ex` @@ -533,30 +472,6 @@ --- -### L10. SidebarCollapse Event Listener Not Cleaned Up - -**File:** `assets/js/app.ts:316-324` - -**Severity:** LOW — Anonymous arrow function can't be removed; listener accumulates - -**Description:** `mounted()` adds event listener but no `destroyed()` method to remove it. - -**Fix:** Add `destroyed()` with stored handler reference. - ---- - -### L11. WebMCP Navigate Path Not Validated - -**File:** `assets/js/app.ts:478-480` - -**Severity:** LOW — `window.location.href = path` could accept `javascript:` URLs - -**Description:** If a compromised WebMCP agent sends a malicious path, user could be navigated to phishing URL. - -**Fix:** Validate path starts with `/`. - ---- - ### L12. `window.liveSocket` Exposed Globally **File:** `assets/js/app.ts:423`