mirror of https://github.com/UNITRONIX/BetterDesk.git synced 2026-10-26 14:30:19 +00:00

Files

T

UNITRONIX 235c9c0706 security: implement Phase 0-3 remediation (deps, SQL ident, JWT, CSP, suite)

Bump axios/multer and npm overrides; add safeSqlIdent and multer cleanup;
harden JWT aud/iss/nbf; CSP without unsafe-eval via static protobuf build
and data-bd-call delegation; ship Security Test Suite v1.2.0 and docs.
Ignore generated RdClient protobuf artifacts (~40k lines) — rebuild locally
with npm run protocols:rdclient.

Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow); muopc (@muopc)

2026-10-17 15:33:48 +02:00

01-sql-injection.test.js

security: implement Phase 0-3 remediation (deps, SQL ident, JWT, CSP, suite)

2026-10-17 15:33:48 +02:00

02-xss.test.js

security: implement Phase 0-3 remediation (deps, SQL ident, JWT, CSP, suite)

2026-10-17 15:33:48 +02:00

03-auth-bypass.test.js

security: implement Phase 0-3 remediation (deps, SQL ident, JWT, CSP, suite)

2026-10-17 15:33:48 +02:00

04-brute-force.test.js

security: implement Phase 0-3 remediation (deps, SQL ident, JWT, CSP, suite)

2026-10-17 15:33:48 +02:00

05-csrf-cors-ssrf.test.js

security: implement Phase 0-3 remediation (deps, SQL ident, JWT, CSP, suite)

2026-10-17 15:33:48 +02:00

06-rustdesk-client-api.test.js

security: implement Phase 0-3 remediation (deps, SQL ident, JWT, CSP, suite)

2026-10-17 15:33:48 +02:00

07-connection-ws.test.js

security: implement Phase 0-3 remediation (deps, SQL ident, JWT, CSP, suite)

2026-10-17 15:33:48 +02:00

08-path-redirect.test.js

security: implement Phase 0-3 remediation (deps, SQL ident, JWT, CSP, suite)

2026-10-17 15:33:48 +02:00

09-deps-audit.test.js

security: implement Phase 0-3 remediation (deps, SQL ident, JWT, CSP, suite)

2026-10-17 15:33:48 +02:00

helpers.js

security: implement Phase 0-3 remediation (deps, SQL ident, JWT, CSP, suite)

2026-10-17 15:33:48 +02:00

payloads.js

security: implement Phase 0-3 remediation (deps, SQL ident, JWT, CSP, suite)

2026-10-17 15:33:48 +02:00

README.md

security: implement Phase 0-3 remediation (deps, SQL ident, JWT, CSP, suite)

2026-10-17 15:33:48 +02:00

suite.manifest.js

security: implement Phase 0-3 remediation (deps, SQL ident, JWT, CSP, suite)

2026-10-17 15:33:48 +02:00

README.md

Security suite (Node)

Defensive Jest modules for the BetterDesk console and RustDesk Client API.

Module	Covers
`01-sql-injection`	SQLi payloads, identifier hygiene
`02-xss`	Output encoding
`03-auth-bypass`	Unauthenticated API + RBAC
`04-brute-force`	Login rate limit
`05-csrf-cors-ssrf`	CSRF, CORS allowlist, SSRF
`06-rustdesk-client-api`	Client API auth, heartbeat spoof, server-key
`07-connection-ws`	WS Origin / CSWSH, BD Bearer
`08-path-redirect`	Path traversal, open redirect
`09-deps-audit`	Min versions for axios / proxy-addr / brace-expansion / multer

Run: npm run test:security from web-nodejs/.

Version / inventory: suite.manifest.js (v1.2.0) — bump when adding modules.

See docs/security/SECURITY_TEST_SUITE.md.