From fc27f2a4a227abcc34a3745a2716158db0e9a61c Mon Sep 17 00:00:00 2001
From: 2GT-Rich <107219997+2GT-Rich@users.noreply.github.com>
Date: Mon, 25 May 2026 15:55:11 -0700
Subject: [PATCH] fix: resolve CodeQL security alerts (v0.11.10 Beta)

Log injection (3 errors fixed):
- errorHandler.ts: sanitize req.path before logging (strip \r\n)
- clients.ts: sanitize mac param in two Flux error log lines

Dismissed as false positives or won't-fix with justifications:
- Insecure Helmet config: CSP intentionally disabled (self-hosted,
  Vite/React inline styles require complex allowlist)
- Permissive CORS: wildcard only active when admin explicitly sets
  CORS_ORIGIN=*, documented as unsafe
- Network data to file (cert.ts x2): intentional cert upload feature
- File system race (oui.ts): trusted startup URL, no attack surface
- Insecure temp file (oui.ts): server-side OUI DB, not user-accessible
- Remote property injection (DeviceCollector.ts): data from trusted
  RouterOS API on admin-credentialed device, not user HTTP input
- Rate limiting (19): all routes behind JWT; login already rate-limited

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 README.md                              | 2 +-
 backend/package.json                   | 2 +-
 backend/src/middleware/errorHandler.ts | 2 +-
 backend/src/routes/clients.ts          | 4 ++--
 frontend/package.json                  | 2 +-
 frontend/src/version.ts                | 2 +-
 6 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/README.md b/README.md
index ed404b5..eb611b7 100644
--- a/README.md
+++ b/README.md
@@ -2,7 +2,7 @@
 
 A self-hosted, full-stack network management platform for MikroTik devices. Monitor, configure, and manage your entire MikroTik infrastructure — routers, switches, and wireless access points — from a single web interface.
 
-![Version](https://img.shields.io/badge/version-0.11.9_Beta-blue)
+![Version](https://img.shields.io/badge/version-0.11.10_Beta-blue)
 ![License](https://img.shields.io/badge/license-AGPLv3-blue)
 ![Docker](https://img.shields.io/badge/docker-compose-2496ED?logo=docker&logoColor=white)
 ![TypeScript](https://img.shields.io/badge/TypeScript-5.3-3178C6?logo=typescript&logoColor=white)
diff --git a/backend/package.json b/backend/package.json
index 47e6505..9bb92b0 100644
--- a/backend/package.json
+++ b/backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "mikrotik-manager-backend",
-  "version": "0.11.9-beta",
+  "version": "0.11.10-beta",
   "description": "Mikrotik Network Management Platform - Backend API",
   "main": "dist/index.js",
   "scripts": {
diff --git a/backend/src/middleware/errorHandler.ts b/backend/src/middleware/errorHandler.ts
index 90ae20f..40bcb77 100644
--- a/backend/src/middleware/errorHandler.ts
+++ b/backend/src/middleware/errorHandler.ts
@@ -6,7 +6,7 @@ export function errorHandler(
   res: Response,
   _next: NextFunction
 ): void {
-  console.error(`[${req.method} ${req.path}]`, err.message);
+  console.error(`[${req.method} ${req.path.replace(/[\r\n]/g, '_')}]`, err.message);
 
   if (res.headersSent) return;
 
diff --git a/backend/src/routes/clients.ts b/backend/src/routes/clients.ts
index b95dc87..ce4b095 100644
--- a/backend/src/routes/clients.ts
+++ b/backend/src/routes/clients.ts
@@ -184,7 +184,7 @@ router.get('/:mac/traffic', async (req: Request, res: Response) => {
       if (time && field && value != null) raw.push({ time, field, value });
     });
   } catch (err) {
-    console.error(`[clients/traffic] Flux error for ${mac}:`, err);
+    console.error(`[clients/traffic] Flux error for ${mac.replace(/[\r\n]/g, '_')}:`, err);
   }
 
   // Separate tx and rx series, sort by time, then compute non-negative deltas
@@ -242,7 +242,7 @@ router.get('/:mac/signal', async (req: Request, res: Response) => {
       if (time && value != null) points.push({ time, signal_strength: Math.round(value) });
     });
   } catch (err) {
-    console.error(`[clients/signal] Flux error for ${mac}:`, err);
+    console.error(`[clients/signal] Flux error for ${mac.replace(/[\r\n]/g, '_')}:`, err);
   }
 
   return res.json(points);
diff --git a/frontend/package.json b/frontend/package.json
index aceea21..e699b90 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "mikrotik-manager-frontend",
-  "version": "0.11.9-beta",
+  "version": "0.11.10-beta",
   "private": true,
   "type": "module",
   "scripts": {
diff --git a/frontend/src/version.ts b/frontend/src/version.ts
index 8f0dc7f..6948e3c 100644
--- a/frontend/src/version.ts
+++ b/frontend/src/version.ts
@@ -1 +1 @@
-export const APP_VERSION = 'v0.11.9 Beta';
+export const APP_VERSION = 'v0.11.10 Beta';