MIKROTIK-RMM

Files

T

2GT-RichandClaude Sonnet 4.6 fc27f2a4a2 fix: resolve CodeQL security alerts (v0.11.10 Beta)

Log injection (3 errors fixed):
- errorHandler.ts: sanitize req.path before logging (strip \r\n)
- clients.ts: sanitize mac param in two Flux error log lines

Dismissed as false positives or won't-fix with justifications:
- Insecure Helmet config: CSP intentionally disabled (self-hosted,
  Vite/React inline styles require complex allowlist)
- Permissive CORS: wildcard only active when admin explicitly sets
  CORS_ORIGIN=*, documented as unsafe
- Network data to file (cert.ts x2): intentional cert upload feature
- File system race (oui.ts): trusted startup URL, no attack surface
- Insecure temp file (oui.ts): server-side OUI DB, not user-accessible
- Remote property injection (DeviceCollector.ts): data from trusted
  RouterOS API on admin-credentialed device, not user HTTP input
- Rate limiting (19): all routes behind JWT; login already rate-limited

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-05-25 15:55:11 -07:00

__tests__

feat: non-blocking bulk-add, CORS hardening, credential preset access control (#31 )

2026-04-21 19:54:35 -07:00

alerts.ts

Initial commit baby!

2026-04-13 18:15:41 -07:00

auditLog.ts

feat: audit log, device tags, maintenance windows (v0.11.3 Beta)

2026-05-16 15:33:15 -07:00

auth.ts

feat: 2FA/TOTP, config templates (v0.11.4 Beta)