towerops/lib/towerops_web/controllers/api
Graham McIntire fb1d4c564f
security: fix critical vulnerabilities and atom exhaustion risks
Critical fixes:
- Add [:safe] option to binary_to_term to prevent RCE attacks
- Implement whitelist validation for String.to_atom conversions
- Add input validation before String.to_existing_atom usage

Changes:
- MIB compiler and cache: Use safe binary deserialization
- SNMP contexts: Whitelist protocol, device type, and source atoms
- API controllers: Validate error message keys before atom conversion
- Reduce function nesting to comply with Credo standards

All 6,145 tests passing with zero Credo issues.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-02-08 10:30:30 -06:00
..
v1 security: fix critical vulnerabilities and atom exhaustion risks 2026-02-08 10:30:30 -06:00
account_data_controller.ex make devices site optional and many test fix 2026-02-04 15:05:42 -06:00
mobile_auth_controller.ex security: fix critical vulnerabilities and atom exhaustion risks 2026-02-08 10:30:30 -06:00
mobile_controller.ex rename equipment to device 2026-01-17 14:48:46 -06:00