Graham McIntire
24ba393954
Security (11 items): - SEC-C1: Cross-tenant agent token disclosure -> org-scoped lookup - SEC-H1/H2/H3/M7: IDOR cluster -> org-scoped context functions - SEC-H4: Impersonation session bypass -> unified token validation - SEC-H5: X-Forwarded-For spoofing -> right-to-left XFF walk - SEC-M1: SSRF in vendor integrations -> URL/IP validation + no redirects - SEC-M2: Agent tokens plaintext -> SHA-256 hash, expires_at, rotation - SEC-M4: SNMP communities logged cleartext -> boolean indicators - SEC-M5: API tokens survive membership revocation -> re-check membership - SEC-M8: Superuser API unrated-limited -> rate_limit_api pipeline - SEC-M9: Internal exceptions in API responses -> generic messages - SEC-L1/L3/L4: Cloak key assertion, channel topic binding, download audit Performance (5 items): - PERF-C1: Alert LiveView full reload -> grouped COUNT + debounce - PERF-H3: Device list plain assign -> stream/3 with dom_id - PERF-H4: RateLimit GenServer serialization -> direct ETS access - PERF-H5: EventLogger serial insert -> batch buffer + insert_all - PERF-H6: StormDetector broken under k8s -> global registration Architecture (3 items): - 4 controllers now use context modules instead of direct Repo calls - 6 vendor HTTP clients consolidated onto Towerops.HTTP - equipment->device renames across 18 files (69 call sites) Dependencies (3 items): - bandit 1.12.0 -> 1.12.3 - Removed unused gen_smtp - Updated vendor/README.md versions Test Health: - 3 test files flipped to async: true - Duplicated fixtures consolidated to shared modules - agent_channel_test (2279 lines) split into 5 files - SNMP community encryption migration + data migration script - MikroTik config download audit logging |
||
|---|---|---|
| .. | ||
| antennas | ||
| gettext | ||
| mibs | ||
| profiles | ||
| proto | ||
| repo | ||
| static | ||