towerops/.pre-commit-config.yaml at 1590f78bdccc57bb6b8049e4a6bb39269a6876f5 - graham/towerops - Forgejo: Beyond coding. We forge.

graham/towerops

Graham McIntie 1590f78bdc fix: input validation, SSRF, API hardening, and cookie security

- LIKE wildcard injection: sanitize %, _ in search queries (devices, sites, gaiia)
- Jason.decode! → Jason.decode with error handling for untrusted input
- inspect() leak: replace with generic error messages, log details server-side
- SSRF protection: URL validator blocks private IPs, localhost, non-HTTP schemes
- SSRF validation added to HTTP monitoring executor and integration credentials
- GraphQL complexity limits: always applied, not just in prod
- GraphQL introspection: also check GET query params, not just body
- Stripe webhook: explicit nil/empty checks for signature and body
- Cookie security: secure flag for session (prod), http_only+secure for remember_me
- Honeybadger API key: read from env var with fallback
- String.to_integer → Integer.parse with fallback for URL params
- String.to_atom → whitelist map for HTTP methods
- Gaiia webhook: remove secret_len and expected signature from log
- Admin API: add rate limiting pipeline
- to_atom_keys: per-key fallback instead of all-or-nothing rescue

2026-03-14 14:48:59 -05:00

Symbolic link

1 line

No EOL

66 B

YAML

Raw Blame History

/nix/store/4xlkmdd947h5qlhj2rmbyavq08grkz27-pre-commit-config.json