Graham McIntire
320ced2d23
- Enforce upload size limit (100 MB), max extracted files (2000), max uncompressed size (500 MB), and reject symlinks in MIB archives - Replace unbounded String.to_atom calls in SNMP tokenizer with safe_atom/1 that warns when approaching the atom table limit - Cache MIB vendor listing with persistent_term, invalidated on upload/delete to avoid blocking synchronous Path.wildcard scans
23 lines
1.5 KiB
Markdown
23 lines
1.5 KiB
Markdown
# Bugs And Risk Findings
|
|
|
|
Review date: 2026-05-11
|
|
|
|
Scope: application-owned Elixir/Phoenix code, templates, config, deployment manifests, scripts, and dependency manifests. Vendored code and bundled third-party MIB data were not reviewed as first-party code.
|
|
|
|
Validation run:
|
|
|
|
- `mix credo --strict`: passed, no issues.
|
|
- `mix deps.audit`: passed, no vulnerabilities found.
|
|
- `mix hex.audit`: passed, no retired packages found.
|
|
- `npm audit --prefix e2e --audit-level=low`: passed, 0 vulnerabilities.
|
|
|
|
## Medium
|
|
|
|
### 6. CSP is duplicated and weakened by inline scripts
|
|
|
|
- Category: OWASP A05 Security Misconfiguration / A03 Injection defense in depth
|
|
- Evidence: `lib/towerops_web/router.ex:21`, `lib/towerops_web/plugs/security_headers.ex:20`, `lib/towerops_web/components/layouts/root.html.heex:35`, `lib/towerops_web/components/layouts/root.html.heex:71`, `lib/towerops_web/components/layouts/root.html.heex:80`
|
|
- Problem: CSP is set in both the browser pipeline and endpoint-level security plug, with different directives. The effective behavior depends on header overwrite order. The policy also requires `'unsafe-inline'` because templates include inline scripts, reducing CSP's value against XSS.
|
|
- Fix: centralize CSP construction in one plug. Move inline scripts into `assets/js/app.js` or LiveView hooks and remove `'unsafe-inline'` where possible. Consider nonces only for unavoidable inline bootstrapping.
|
|
- Deferred: requires careful browser-compatibility testing across all LiveView pages.
|
|
|