ca7bb75472
fix: 11 critical security/correctness bugs from code audit
...
- C1: Replace innerHTML template literals with DOM textContent in sites_map.ts
- C2: Derive user_id from current_scope instead of client params in policy consent
- C3: Fix broken halt() in GDPR data export (orphaned _ = ... halt())
- C4: Add owner/admin authorization check to MembersController update/delete
- C5: Require HMAC signature on agent release webhook (was optional)
- C6: Fix Repo.all_by/2 (not a real Ecto function) → Repo.all with query
- C7: Move auth exemption to before_send callback in BruteForceProtection
- C8: Block </style>/<script injection in status page custom_css validation
- C9: Create secrets.example.yaml with placeholders; secrets.yaml already gitignored
- C10: Load Stripe key from STRIPE_SECRET_KEY env var instead of hardcoded value
- C13: Remove credentials from PubSub backup broadcast; channel resolves them
C11 (no force_ssl): by design — Cloudflared terminates TLS
C12 (device quota race): false positive — FOR UPDATE serializes correctly
2026-05-12 10:20:52 -05:00
91e3181bbc
dialyzer: fix all unmatched_return warnings (154 → 0)
...
Prefix fire-and-forget calls (PubSub.broadcast, Oban enqueue, Logger,
update_*, etc.) with `_ =` so dialyzer knows the return value is
intentionally discarded. Wrap a few if/case expressions whose
branches produce mixed types the same way.
No behavior changes — only explicit acknowledgement of discarded
returns.
Warnings: 242 → 88.
2026-04-21 10:03:55 -05:00
1d928d4356
security: implement comprehensive security audit fixes
...
Critical Fixes:
- Remove /health/time endpoint exposing system time information
* Prevents attackers from detecting time sync issues for TOTP attacks
* Removed route and controller function, updated tests
- Add email confirmation check to account data export
* GDPR export now requires confirmed email address
* Prevents unconfirmed accounts from accessing data export
- Add path traversal validation for MIB archive uploads
* Extract to temp directory, validate all paths, then copy if safe
* Prevents malicious tar/zip files from writing outside target directory
* Added validate_extracted_paths/1 helper function
High Priority Fixes:
- Add comprehensive input validation for mobile auth
* Length limits: device_name (255), device_os (100), app_version (50), push_token (512)
* Prevents database corruption and storage exhaustion
- Add heartbeat rate limiting to agent channel
* Limit database updates to once per 30 seconds (max ~2/min per agent)
* Prevents malicious agents from exhausting database connections
- Sanitize 500 error responses
* Return generic error messages to clients
* Log full details server-side with request_id for support
* Prevents leaking stack traces and module names
- Add message size limits to agent channel
* 10MB maximum for all protobuf messages (result, heartbeat, error)
* Prevents DoS attacks via oversized payloads
Medium Priority Fixes:
- Add GraphQL query depth limits (max_depth: 10)
* Prevents DoS from deeply nested queries
* Complements existing complexity limits
Code Quality:
- Refactor agent channel handlers to reduce nesting depth
* Extract message processing into separate private functions
* Fixes Credo warnings about excessive nesting
* Improves code readability and maintainability
Files changed:
- lib/towerops_web/controllers/health_controller.ex
- lib/towerops_web/controllers/api/account_data_controller.ex
- lib/towerops_web/controllers/api/v1/mib_controller.ex
- lib/towerops/mobile_sessions/mobile_session.ex
- lib/towerops_web/channels/agent_channel.ex
- lib/towerops_web/controllers/error_json.ex
- lib/towerops_web/router.ex
- CHANGELOG.txt
- priv/static/changelog.txt
- test/towerops_web/controllers/health_controller_test.exs
- test/towerops_web/controllers/error_json_test.exs
All 7,424 tests passing.
2026-03-05 13:08:10 -06:00
8382b5df6a
make devices site optional and many test fix
2026-02-04 15:05:42 -06:00
e46ecbfca2
Replace single name field with first_name and last_name
2026-02-01 15:00:23 -06:00
3c00dcf37c
remove passkeys for now
2026-01-31 09:50:35 -06:00
22ae257b60
refactor
2026-01-31 09:35:07 -06:00
6ca22c5dd0
enhance user auditing
2026-01-30 17:38:07 -06:00
aed15dd6a1
impersonate fixes
2026-01-28 14:41:27 -06:00
220f1edce3
cookie improvements
2026-01-28 12:30:28 -06:00
