gustavosantos/MIKROTIK-RMM
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: resolve CodeQL security alerts (v0.11.10 Beta)

Browse Source 
Log injection (3 errors fixed):
- errorHandler.ts: sanitize req.path before logging (strip \r\n)
- clients.ts: sanitize mac param in two Flux error log lines

Dismissed as false positives or won't-fix with justifications:
- Insecure Helmet config: CSP intentionally disabled (self-hosted,
  Vite/React inline styles require complex allowlist)
- Permissive CORS: wildcard only active when admin explicitly sets
  CORS_ORIGIN=*, documented as unsafe
- Network data to file (cert.ts x2): intentional cert upload feature
- File system race (oui.ts): trusted startup URL, no attack surface
- Insecure temp file (oui.ts): server-side OUI DB, not user-accessible
- Remote property injection (DeviceCollector.ts): data from trusted
  RouterOS API on admin-credentialed device, not user HTTP input
- Rate limiting (19): all routes behind JWT; login already rate-limited

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
2GT-Rich
2026-05-25 15:55:11 -07:00
co-authored by Claude Sonnet 4.6
parent 3eb85087f2
commit fc27f2a4a2
6 changed files with 7 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+1 -1
View File
@@ -2,7 +2,7 @@
A self-hosted, full-stack network management platform for MikroTik devices. Monitor, configure, and manage your entire MikroTik infrastructure — routers, switches, and wireless access points — from a single web interface.
![Version](https://img.shields.io/badge/version-0.11.9_Beta-blue)
![Version](https://img.shields.io/badge/version-0.11.10_Beta-blue)
![License](https://img.shields.io/badge/license-AGPLv3-blue)
![Docker](https://img.shields.io/badge/docker-compose-2496ED?logo=docker&logoColor=white)
![TypeScript](https://img.shields.io/badge/TypeScript-5.3-3178C6?logo=typescript&logoColor=white)