mirror of https://github.com/UNITRONIX/BetterDesk.git synced 2026-10-26 06:19:53 +00:00

Files

T

UNITRONIX 8d3a5d4a69 fix(rbac): enforce persisted role permission overrides

Align the Node panel with Go role_permissions, protect user-directory paths and relays, and add regression coverage. Make the embedded worker test explicitly select its optional maintainer mode.

Refs #468

Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow); muopc (@muopc)

2026-10-21 01:31:03 +02:00

01-sql-injection.test.js

security: implement Phase 0-3 remediation (deps, SQL ident, JWT, CSP, suite)

2026-10-17 15:33:48 +02:00

02-xss.test.js

security: implement Phase 0-3 remediation (deps, SQL ident, JWT, CSP, suite)

2026-10-17 15:33:48 +02:00

03-auth-bypass.test.js

fix(rbac): enforce persisted role permission overrides

2026-10-21 01:31:03 +02:00

04-brute-force.test.js

security: implement Phase 0-3 remediation (deps, SQL ident, JWT, CSP, suite)

2026-10-17 15:33:48 +02:00

05-csrf-cors-ssrf.test.js

security: implement Phase 0-3 remediation (deps, SQL ident, JWT, CSP, suite)

2026-10-17 15:33:48 +02:00

06-rustdesk-client-api.test.js

security: implement Phase 0-3 remediation (deps, SQL ident, JWT, CSP, suite)

2026-10-17 15:33:48 +02:00

07-connection-ws.test.js

security: implement Phase 0-3 remediation (deps, SQL ident, JWT, CSP, suite)

2026-10-17 15:33:48 +02:00

08-path-redirect.test.js

security: implement Phase 0-3 remediation (deps, SQL ident, JWT, CSP, suite)

2026-10-17 15:33:48 +02:00

09-deps-audit.test.js

security: implement Phase 0-3 remediation (deps, SQL ident, JWT, CSP, suite)

2026-10-17 15:33:48 +02:00

helpers.js

security: implement Phase 0-3 remediation (deps, SQL ident, JWT, CSP, suite)

2026-10-17 15:33:48 +02:00

payloads.js

security: implement Phase 0-3 remediation (deps, SQL ident, JWT, CSP, suite)

2026-10-17 15:33:48 +02:00

README.md

security: implement Phase 0-3 remediation (deps, SQL ident, JWT, CSP, suite)

2026-10-17 15:33:48 +02:00

suite.manifest.js

security: implement Phase 0-3 remediation (deps, SQL ident, JWT, CSP, suite)

2026-10-17 15:33:48 +02:00

README.md

Security suite (Node)

Defensive Jest modules for the BetterDesk console and RustDesk Client API.

Module	Covers
`01-sql-injection`	SQLi payloads, identifier hygiene
`02-xss`	Output encoding
`03-auth-bypass`	Unauthenticated API + RBAC
`04-brute-force`	Login rate limit
`05-csrf-cors-ssrf`	CSRF, CORS allowlist, SSRF
`06-rustdesk-client-api`	Client API auth, heartbeat spoof, server-key
`07-connection-ws`	WS Origin / CSWSH, BD Bearer
`08-path-redirect`	Path traversal, open redirect
`09-deps-audit`	Min versions for axios / proxy-addr / brace-expansion / multer

Run: npm run test:security from web-nodejs/.

Version / inventory: suite.manifest.js (v1.2.0) — bump when adding modules.

See docs/security/SECURITY_TEST_SUITE.md.