mirror of https://github.com/UNITRONIX/BetterDesk.git synced 2026-10-26 22:37:07 +00:00

Files

T

UNITRONIX db07c5c5af feat(auth): enforce idle timeout and single panel session per account

Server-side session policy replaces long-lived idle console logins: sliding
idle timeout, absolute max age, atomic replacement of prior sessions, IP/UA
audit metadata, and consistent expired-login redirects.

Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow); muopc (@muopc)

2026-10-19 10:19:56 +02:00

01-sql-injection.test.js

security: implement Phase 0-3 remediation (deps, SQL ident, JWT, CSP, suite)

2026-10-17 15:33:48 +02:00

02-xss.test.js

security: implement Phase 0-3 remediation (deps, SQL ident, JWT, CSP, suite)

2026-10-17 15:33:48 +02:00

03-auth-bypass.test.js

feat(auth): enforce idle timeout and single panel session per account

2026-10-19 10:19:56 +02:00

04-brute-force.test.js

security: implement Phase 0-3 remediation (deps, SQL ident, JWT, CSP, suite)

2026-10-17 15:33:48 +02:00

05-csrf-cors-ssrf.test.js

security: implement Phase 0-3 remediation (deps, SQL ident, JWT, CSP, suite)

2026-10-17 15:33:48 +02:00

06-rustdesk-client-api.test.js

security: implement Phase 0-3 remediation (deps, SQL ident, JWT, CSP, suite)

2026-10-17 15:33:48 +02:00

07-connection-ws.test.js

security: implement Phase 0-3 remediation (deps, SQL ident, JWT, CSP, suite)

2026-10-17 15:33:48 +02:00

08-path-redirect.test.js

security: implement Phase 0-3 remediation (deps, SQL ident, JWT, CSP, suite)

2026-10-17 15:33:48 +02:00

09-deps-audit.test.js

security: implement Phase 0-3 remediation (deps, SQL ident, JWT, CSP, suite)

2026-10-17 15:33:48 +02:00

helpers.js

security: implement Phase 0-3 remediation (deps, SQL ident, JWT, CSP, suite)

2026-10-17 15:33:48 +02:00

payloads.js

security: implement Phase 0-3 remediation (deps, SQL ident, JWT, CSP, suite)

2026-10-17 15:33:48 +02:00

README.md

security: implement Phase 0-3 remediation (deps, SQL ident, JWT, CSP, suite)

2026-10-17 15:33:48 +02:00

suite.manifest.js

security: implement Phase 0-3 remediation (deps, SQL ident, JWT, CSP, suite)

2026-10-17 15:33:48 +02:00

README.md

Security suite (Node)

Defensive Jest modules for the BetterDesk console and RustDesk Client API.

Module	Covers
`01-sql-injection`	SQLi payloads, identifier hygiene
`02-xss`	Output encoding
`03-auth-bypass`	Unauthenticated API + RBAC
`04-brute-force`	Login rate limit
`05-csrf-cors-ssrf`	CSRF, CORS allowlist, SSRF
`06-rustdesk-client-api`	Client API auth, heartbeat spoof, server-key
`07-connection-ws`	WS Origin / CSWSH, BD Bearer
`08-path-redirect`	Path traversal, open redirect
`09-deps-audit`	Min versions for axios / proxy-addr / brace-expansion / multer

Run: npm run test:security from web-nodejs/.

Version / inventory: suite.manifest.js (v1.2.0) — bump when adding modules.

See docs/security/SECURITY_TEST_SUITE.md.