graham/towerops
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

remove fixed bugs (H12, L2, L5, L6, L8, L10, L11) from bugs.md

Browse source
This commit is contained in:
Graham McIntire 2026-05-12 11:27:32 -05:00
parent 97232117f5
commit d9afb6a3e4
1 changed files with 0 additions and 85 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

85
bugs.md
View file

@ -43,19 +43,6 @@
---
### H12. Missing `Secure` and `HttpOnly` on Session Cookie
**File:** `lib/towerops_web/endpoint.ex:8-14`
**File:** `lib/towerops/user_auth.ex:29-33` (remember-me cookie)
**Severity:** HIGH — Session cookie sent over HTTP; accessible via JS
**Description:** `@session_options` has `same_site: "Lax"` but no `secure: true` or `http_only: true`. Session cookie transmitted in cleartext over HTTP and accessible via `document.cookie`.
**Fix:** Add `secure: true, http_only: true` to both session and remember-me cookie configs.
---
### H13. PromEx Metrics Server Unauthenticated
**File:** `config/config.exs:106-117`
@ -437,18 +424,6 @@
---
### L2. 404 Tracker EXPIRE Without NX Flag
**File:** `lib/towerops/security/four_oh_four_tracker.ex:32`
**Severity:** LOW — Attacker can extend tracking window indefinitely
**Description:** `EXPIRE` called on every 404 regardless of whether key already exists. NO `NX` option means each hit refreshes the TTL.
**Fix:** Use `EXPIRE key 60 NX` to only set expiry on first creation.
---
### L3. IPv4-Mapped IPv6 Not Handled in Whitelist
**File:** `lib/towerops/security/brute_force.ex:36-49`
@ -473,30 +448,6 @@
---
### L5. Vault Initialization Reads Prod Key in Dev
**File:** `lib/towerops/vault.ex:29`
**Severity:** LOW — If `CLOAK_KEY` env var is set, dev uses production encryption key
**Description:** `if System.get_env("CLOAK_KEY") do` — no environment guard. A developer with prod env set will use the production key in dev.
**Fix:** Only read `CLOAK_KEY` in production, or use a separate `CLOAK_KEY_DEV`.
---
### L6. Health Endpoint Leaks App Version
**File:** `lib/towerops_web/controllers/health_controller.ex:29`
**Severity:** LOW — Helps attackers identify vulnerable versions
**Description:** `Application.spec(:towerops, :vsn)` returned publicly.
**Fix:** Remove version from public health endpoint.
---
### L7. Device Capacity Operations Missing Org Scoping
**File:** `lib/towerops_web/live/device_live/show.ex:728-757`
@ -509,18 +460,6 @@
---
### L8. Insights Dismiss Missing Org Scope
**File:** `lib/towerops_web/live/insights_live/index.ex:71-82`
**Severity:** LOW — IDOR on dismiss, but low impact (read-only dismissal)
**Description:** `Preseem.dismiss_insight(id)` with no org scope check.
**Fix:** Verify org ownership before dismissing.
---
### L9. Duplicate Pattern in Sync Workers
**Files:** `gaiia_sync_worker.ex`, `sonar_sync_worker.ex`, `splynx_sync_worker.ex`, `visp_sync_worker.ex`, `netbox_sync_worker.ex`
@ -533,30 +472,6 @@
---
### L10. SidebarCollapse Event Listener Not Cleaned Up
**File:** `assets/js/app.ts:316-324`
**Severity:** LOW — Anonymous arrow function can't be removed; listener accumulates
**Description:** `mounted()` adds event listener but no `destroyed()` method to remove it.
**Fix:** Add `destroyed()` with stored handler reference.
---
### L11. WebMCP Navigate Path Not Validated
**File:** `assets/js/app.ts:478-480`
**Severity:** LOW — `window.location.href = path` could accept `javascript:` URLs
**Description:** If a compromised WebMCP agent sends a malicious path, user could be navigated to phishing URL.
**Fix:** Validate path starts with `/`.
---
### L12. `window.liveSocket` Exposed Globally
**File:** `assets/js/app.ts:423`