UNITRONIX 44221f721b fix(security): close remaining CodeQL findings before 3.5.5 ...

Confine multer unlink to reconstructed safe paths, rate-limit public
agent downloads, allowlist GitHub fetch hosts and local builder tools.
Expand CodeQL query filters for validated false positives.

Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow); muopc (@muopc)

2026-10-17 16:32:23 +02:00

..

security

security: implement Phase 0-3 remediation (deps, SQL ident, JWT, CSP, suite)

2026-10-17 15:33:48 +02:00

agentBundleConnection.test.js

Complete web console i18n audit and refine server attestation.

2026-06-06 02:36:57 +02:00

agentBundleService.security.test.js

feat(generator): allow custom download portal product label

2026-08-29 21:58:03 +02:00

agentBundleSlug.test.js

feat(i18n): add short link functionality and validation messages across multiple languages

2026-06-06 09:18:48 +02:00

agentClientBuildWorker.test.js

chore: update .gitignore and Gitleaks configuration, enhance CI workflows

2026-07-13 17:34:41 +02:00

auth.routes.test.js

fix: resolve relay metadata and settings navigation issues

2026-10-14 22:48:31 +02:00

authService.providers.test.js

fix(auth): show username collision when LDAP matches local account (#148)

2026-06-07 00:32:03 +02:00

authService.totp.test.js

fix(keys): encode RustDesk config QR as reversed deploy string

2026-08-14 06:52:41 +02:00

bd-api.routes.test.js

fix(security): harden update restore and notification CSRF

2026-08-23 21:08:05 +02:00

billingClockConfigService.docker.test.js

fix(docker): hot-reload billing clock settings in split deployments

2026-09-20 17:26:32 +02:00

billingClockConfigService.test.js

Fix NTP server config not reaching betterdesk-server (Fixes #223).

2026-06-27 20:33:56 +02:00

bodyScalars.test.js

fix(security): resolve CodeQL type-confusion and extend query exclusions

2026-06-12 06:19:04 +02:00

bootstrapAdminCredentials.test.js

fix(docker): restore Web Console CI bootstrap/guard gates

2026-10-17 16:03:35 +02:00

branding.routes.test.js

fix(ui): remove unsupported appearance icons

2026-09-19 11:15:22 +02:00

cdap.routes.test.js

Enhance security and input validation across CDAP and organization routes

2026-07-09 21:16:55 +02:00

chatRelay.protocol.test.js

fix(console): polish dashboard chat and accessibility

2026-10-03 10:44:20 +02:00

clientBuilderService.test.js

feat(generator): add generic agent releases and QR activation

2026-10-11 00:43:26 +02:00

clientConfigHost.test.js

fix(ui): warn on unreachable config QR hosts (#368)

2026-08-17 06:55:04 +02:00

clientTemplateWorker.embedded.test.js

feat(generator): add generic agent releases and QR activation

2026-10-11 00:43:26 +02:00

commercializationClockDocker.test.js

fix(docker): skip native NTP restart prompt in split mode

2026-10-08 07:59:21 +02:00

commercializationCsrf.test.js

feat(billing): refactor billing contract management and enhance API

2026-07-09 06:39:25 +02:00

commercializationEmailConfig.test.js

feat: add email notification system and SMTP configuration

2026-06-14 09:04:04 +02:00

consoleDeployGraph.test.js

fix(update): skip repair download for removed console files

2026-06-09 02:31:54 +02:00

consoleNpmInstall.test.js

feat(update): implement last update result reporting in settings

2026-06-07 15:06:48 +02:00

customTxtBuilder.test.js

Complete BetterDesk Support generator workflow

2026-09-19 18:53:19 +02:00

database.facade.parity.test.js

fix(generator): expose generation methods through database facade

2026-10-05 08:18:37 +02:00

databaseSessionStore.test.js

feat(auth): implement SQLite auth consolidation and admin password validation

2026-08-05 23:49:42 +02:00

dbAdapter.generatorBundles.test.js

fix(generator): align local builds with provider capabilities

2026-10-05 06:55:59 +02:00

dbAdapter.renameRoundTrip.test.js

feat(security): integrate reviewed contributor fixes on dev

2026-09-17 03:44:18 +02:00

dbAdapter.singleStore.test.js

fix(docker): make split admin bootstrap atomic

2026-08-25 02:13:40 +02:00

dbAdapter.tokenHashMigration.test.js

feat(auth): implement SQLite auth consolidation and admin password validation

2026-08-05 23:49:42 +02:00

dbAdapter.userStrategyAssignment.test.js

fix(users): implement missing ensureUserGuid for strategy assignment

2026-08-24 14:25:23 +02:00

deviceAuth.middleware.test.js

fix(security): finish privileged update path and relay auth tests

2026-08-15 23:29:01 +02:00

deviceGroupEmailRouting.test.js

feat: add email notification system and SMTP configuration

2026-06-14 09:04:04 +02:00

deviceGroupService.scope.test.js

feat: user scope UX, role labels, and device visibility defaults (#227)

2026-07-05 19:44:18 +02:00

devices.routes.test.js

feat(devices): queue reversible desktop connection mode

2026-09-22 08:40:08 +02:00

dockerBootstrapCredentials.test.js

fix(docker): restore Web Console CI bootstrap/guard gates

2026-10-17 16:03:35 +02:00

dockerBuildContract.test.js

fix(docker): restore Web Console CI bootstrap/guard gates

2026-10-17 16:03:35 +02:00

dockerGuardSqliteAuthSplit.test.js

fix(docker): guard against split-volume stale auth.db (#385)

2026-08-25 23:22:06 +02:00

dockerSplitLogin.integration.test.js

fix(docker): serialize split admin bootstrap

2026-09-26 02:25:51 +02:00

ensureDefaultAdmin.test.js

fix(docker): serialize split admin bootstrap

2026-09-26 02:25:51 +02:00

envMerge.test.js

Complete web console i18n audit and refine server attestation.

2026-06-06 02:36:57 +02:00

envMergeSubst.test.js

Complete web console i18n audit and refine server attestation.

2026-06-06 02:36:57 +02:00

filetransfer.logic.test.js

feat(security): integrate reviewed contributor fixes on dev

2026-09-17 03:44:18 +02:00

fontService.test.js

chore: remove outdated build workflow and update CI configurations

2026-06-20 18:08:54 +02:00

generatorBuildTypes.test.js

fix(generator): show leftover download pages so they can be deleted

2026-09-11 12:24:24 +02:00

goApiPath.test.js

fix(security): phase-D Go API ID guards across all proxy routes

2026-06-09 03:13:53 +02:00

goApiProxy.test.js

fix(security): phase-E shared Go API proxy, XSS hardening, audit clamp

2026-06-09 03:22:14 +02:00

guestAccess.integration.test.js

feat(guest): enforce scoped guest access lifecycle

2026-10-03 10:22:20 +02:00

guestAccess.test.js

fix(web-remote): guest page 500 and cookie hijack (Refs #274)

2026-07-20 23:29:52 +02:00

helpers.js

Enhance security and input validation across CDAP and organization routes

2026-07-09 21:16:55 +02:00

helpRequestEmailService.test.js

feat: add email notification system and SMTP configuration

2026-06-14 09:04:04 +02:00

i18n.test.js

feat(web): add Auth TOTP and scheduled full backups

2026-10-17 13:31:23 +02:00

installerProtocolCheck.test.js

ci: restore dev action checks

2026-09-13 21:37:13 +02:00

inventory.routes.test.js

feat(auth): implement SQLite auth consolidation and admin password validation

2026-08-05 23:49:42 +02:00

keyService.test.js

fix(keys): encode RustDesk config QR as reversed deploy string

2026-08-14 06:52:41 +02:00

linuxEnsureConsoleUser.test.js

fix(security): finish privileged update path and relay auth tests

2026-08-15 23:29:01 +02:00

linuxServerBinaryDeploy.test.js

fix(updates): harden Go binary rebuild version and backup path

2026-09-18 10:18:35 +02:00

linuxSystemdUnitPrivileged.test.js

fix(installer): harden cross-platform lifecycle reliability

2026-08-15 21:50:47 +02:00

localClientBuilder.test.js

feat(generator): add generic agent releases and QR activation

2026-10-11 00:43:26 +02:00

localFiles.base64.test.js

fix(rdclient): recover Cliprdr stack and stop 0KB remote files (Refs #350)

2026-08-06 22:05:58 +02:00

logger.test.js

security(3.4): harden console and Go server for pre-release audit

2026-07-12 20:44:46 +02:00

logRedact.test.js

security(3.4): harden console and Go server for pre-release audit

2026-07-12 20:44:46 +02:00

managementCapabilities.test.js

feat: add BetterDesk management capabilities

2026-09-18 20:45:57 +02:00

mesh.routes.test.js

feat(mesh): default-on migration, panel closure, KVM multiplex, WoL bridge

2026-06-21 23:38:07 +02:00

middleware.auth.test.js

chore: remove outdated build workflow and update CI configurations

2026-06-20 18:08:54 +02:00

mobile-shell.test.js

fix(web-remote): prevent mobile canvas flicker

2026-09-24 23:30:09 +02:00

multerCleanup.test.js

fix(security): close remaining CodeQL findings before 3.5.5

2026-10-17 16:32:23 +02:00

oidcRedirectUrl.test.js

fix(ci): replace operator LAN IP in OIDC redirect URL test

2026-07-31 19:53:36 +02:00

organizations.routes.test.js

Enhance security and input validation across CDAP and organization routes

2026-07-09 21:16:55 +02:00

parseTrustProxy.test.js

Fix console crash when TRUST_PROXY=true in .env (#163)

2026-06-05 02:14:40 +02:00

privilegedPorts.test.js

fix: honour CAP_NET_BIND_SERVICE for native HTTPS on :443 (#219)

2026-07-14 18:00:25 +02:00

privilegedUpdateHelper.test.js

feat: add BetterDesk management capabilities

2026-09-18 20:45:57 +02:00

productVersion.test.js

fix(updates): harden Go binary rebuild version and backup path

2026-09-18 10:18:35 +02:00

rateLimiter.test.js

fix(panel): address first-testing UX feedback from #424

2026-09-16 07:10:50 +02:00

rdclient.clipboard.test.js

fix(security): patch Dependabot and CodeQL alerts on axios, mesh, OIDC

2026-07-20 23:52:32 +02:00

rdclient.connect.test.js

fix(rdclient): align web connect with server connection policy

2026-09-09 11:47:25 +02:00

rdclient.crypto.test.js

fix(web-remote): harden SignedId key verify after #313 (Refs #313)

2026-07-29 20:10:01 +02:00

rdclient.input.test.js

feat(audit): align with RustDesk 1.4.8 and update language files

2026-07-06 21:15:43 +02:00

rdclient.protocol.test.js

fix(rdclient): recover Cliprdr stack and stop 0KB remote files (Refs #350)

2026-08-06 22:05:58 +02:00

rdclient.relayTransport.test.js

feat(guest): enforce scoped guest access lifecycle

2026-10-03 10:22:20 +02:00

rdclient.sessionIsolation.test.js

fix(rdclient): restore keyboard parity with RustDesk native Map path

2026-07-05 00:53:44 +02:00

readAdminCredentialsFile.test.js

fix(docker): sync bootstrap admin password between Go and console (#385)

2026-08-24 15:08:35 +02:00

registration.routes.test.js

fix(enrollment): global pending badge and legacy reject IP (#351)

2026-08-10 22:36:11 +02:00

registrationNotifications.test.js

fix(console): surface registration notifications and stabilize relay delivery

2026-08-23 15:27:13 +02:00

remoteViewerPrefs.test.js

feat: support FPS modes in web sessions

2026-09-12 18:50:06 +02:00

restartFlow.ui.test.js

fix(docker): hot-reload billing clock settings in split deployments

2026-09-20 17:26:32 +02:00

rustdesk-api.routes.test.js

fix: enhance API handling and rate limiting for panel and desktop layout

2026-07-05 21:16:50 +02:00

rustdeskAddressBookSync.test.js

fix(security): Address Book ACL filter and legacy role CHECK migration (#342)

2026-08-01 16:53:18 +02:00

rustDeskPublicEndpointsService.test.js

fix(console): persist Public Client Endpoints across Docker recreate (#291)

2026-07-21 17:32:43 +02:00

safePath.test.js

fix(security): harden CodeQL findings across console and Go server

2026-06-11 06:57:58 +02:00

scheduledBackupService.test.js

feat(web): add Auth TOTP and scheduled full backups

2026-10-17 13:31:23 +02:00

security-audit.routes.test.js

fix(console): polish dashboard chat and accessibility

2026-10-03 10:44:20 +02:00

security.middleware.test.js

security: implement Phase 0-3 remediation (deps, SQL ident, JWT, CSP, suite)

2026-10-17 15:33:48 +02:00

server-attestation.routes.test.js

feat(attestation): customize server badge labels

2026-09-25 10:59:44 +02:00

serverAttestation.badgeConfig.test.js

feat(attestation): customize server badge labels

2026-09-25 10:59:44 +02:00

serverConnectionConfig.docker.test.js

fix(split-docker): unlock connection strategy settings

2026-09-25 00:04:22 +02:00

serverConnectionConfig.test.js

fix(panel): persist connection mode via privileged systemd drop-in

2026-09-18 10:29:26 +02:00

serverManagement.security.test.js

feat: add BetterDesk management capabilities

2026-09-18 20:45:57 +02:00

smtpSettings.test.js

fix(settings): use Utils.api for SMTP settings to fix HTTP 415 (Fixes #240)

2026-07-05 21:30:26 +02:00

ssrfGuard.test.js

Harden console security and wire fixes into the update flow.

2026-06-06 14:40:51 +02:00

supportInstallers.test.js

Complete BetterDesk Support generator workflow

2026-09-19 18:53:19 +02:00

theme-palette.test.js

feat(settings): simplify appearance configuration

2026-09-19 11:00:34 +02:00

tokenHash.test.js

Harden console security and wire fixes into the update flow.

2026-06-06 14:40:51 +02:00

updateFailurePolicy.test.js

feat(update): use commit-bound Go server artifacts

2026-08-23 20:56:45 +02:00

updateProjectRoot.test.js

fix(windows): avoid drive-root PROJECT_ROOT breaking panel updates (Refs #272)

2026-07-16 19:38:29 +02:00

updateResultStore.test.js

fix: clear stale update results and improve update handling

2026-06-10 04:26:18 +02:00

updateService.channel.test.js

fix(updates): build server locally from minimal sources

2026-09-13 21:59:44 +02:00

updateService.consoleSync.test.js

fix(update): preserve explicit config file extensions

2026-09-19 11:04:49 +02:00

updateService.docker.test.js

fix(auth,signal): OIDC user.info, viewer-only outbound, Docker channel UX

2026-07-30 19:10:44 +02:00

updateService.nonCritical.test.js

fix(windows): avoid drive-root PROJECT_ROOT breaking panel updates (Refs #272)

2026-07-16 19:38:29 +02:00

updateService.serverBinary.test.js

fix(updates): build server locally from minimal sources

2026-09-13 21:59:44 +02:00

users.routes.test.js

feat(oidc): add SSO-first login and role overrides

2026-10-12 11:14:20 +02:00

userScopeService.test.js

fix(security): harden update restore and notification CSRF

2026-08-23 21:08:05 +02:00

userSync.test.js

feat(console): coordinate service restarts and login metadata

2026-09-18 18:26:42 +02:00

ux35-ui-contract.test.js

feat(web): add Auth TOTP and scheduled full backups

2026-10-17 13:31:23 +02:00

validation.test.js

Add tests, i18n updates, chat & remote fixes

2026-03-27 00:34:12 +01:00

wanSecurity.test.js

fix: keep WAN heartbeat stable

2026-09-13 18:17:45 +02:00

windowsSupportInstaller.test.js

fix: stabilize BetterDesk API and support installer

2026-09-13 12:54:08 +02:00

writeInstallerEnvSubst.test.js

fix(installer): harden cross-platform lifecycle reliability

2026-08-15 21:50:47 +02:00

wsRelay.framing.test.js

fix(relay): preserve empty RustDesk raw frames

2026-09-24 22:48:02 +02:00

wsRelay.security.test.js

feat(guest): enforce scoped guest access lifecycle

2026-10-03 10:22:20 +02:00

wsUpgradeRouter.test.js

fix(console): share one WebSocket upgrade dispatcher (#295)

2026-07-22 18:21:50 +02:00