graham/towerops
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
towerops/bugs.md
Graham McIntire 320ced2d23 fix: MIB archive bomb protection, atom exhaustion guard, and vendor caching 
- Enforce upload size limit (100 MB), max extracted files (2000), max
  uncompressed size (500 MB), and reject symlinks in MIB archives
- Replace unbounded String.to_atom calls in SNMP tokenizer with
  safe_atom/1 that warns when approaching the atom table limit
- Cache MIB vendor listing with persistent_term, invalidated on
  upload/delete to avoid blocking synchronous Path.wildcard scans
2026-05-12 08:31:01 -05:00

1.5 KiB
Raw Blame History

Bugs And Risk Findings

Review date: 2026-05-11

Scope: application-owned Elixir/Phoenix code, templates, config, deployment manifests, scripts, and dependency manifests. Vendored code and bundled third-party MIB data were not reviewed as first-party code.

Validation run:

  • mix credo --strict: passed, no issues.
  • mix deps.audit: passed, no vulnerabilities found.
  • mix hex.audit: passed, no retired packages found.
  • npm audit --prefix e2e --audit-level=low: passed, 0 vulnerabilities.

Medium

6. CSP is duplicated and weakened by inline scripts

  • Category: OWASP A05 Security Misconfiguration / A03 Injection defense in depth
  • Evidence: lib/towerops_web/router.ex:21, lib/towerops_web/plugs/security_headers.ex:20, lib/towerops_web/components/layouts/root.html.heex:35, lib/towerops_web/components/layouts/root.html.heex:71, lib/towerops_web/components/layouts/root.html.heex:80
  • Problem: CSP is set in both the browser pipeline and endpoint-level security plug, with different directives. The effective behavior depends on header overwrite order. The policy also requires 'unsafe-inline' because templates include inline scripts, reducing CSP's value against XSS.
  • Fix: centralize CSP construction in one plug. Move inline scripts into assets/js/app.js or LiveView hooks and remove 'unsafe-inline' where possible. Consider nonces only for unavoidable inline bootstrapping.
  • Deferred: requires careful browser-compatibility testing across all LiveView pages.