gsadmin/pulse

mirror of https://github.com/rcourtman/Pulse.git synced 2026-09-11 22:12:23 +00:00

Files

T

History

rcourtman 5147b59fa0 Security: Fix path traversal vulnerability in host-agent download endpoint

CRITICAL SECURITY FIX: The /download/pulse-host-agent endpoint was directly
concatenating user-supplied platform and arch query parameters into file paths
without validation, allowing path traversal attacks.

An attacker could request:
  /download/pulse-host-agent?platform=../../etc/passwd
to read arbitrary files from the container filesystem.

Fix: Add input validation to only allow alphanumeric characters and hyphens
in platform/arch parameters before using them in file paths.

Related: Codex security audit identified this during pre-release review

2025-11-12 16:27:11 +00:00

..

alerts_test.go

Allow printable alert IDs for acknowledgements (#550 )

2025-10-14 16:48:22 +00:00

alerts.go

Implement Pulse tag overrides and alert clear persistence

2025-10-25 14:28:32 +00:00

auth_scope_test.go

Add API token scopes and standalone host agent

2025-10-23 11:40:31 +00:00

auth.go

Refactor: Code cleanup and localStorage consolidation

2025-11-04 21:50:46 +00:00

bootstrap_token.go

Improve bootstrap token UX for easier discovery

2025-11-06 17:29:49 +00:00

config_handlers_auto_register_test.go

Harden setup token flow and enforce encrypted persistence

2025-10-25 16:00:37 +00:00

config_handlers_cluster_test.go

Respect custom ports when discovering Proxmox clusters

2025-10-22 17:42:52 +00:00

config_handlers_setup_script_test.go

Refactor: Code cleanup and localStorage consolidation

2025-11-04 21:50:46 +00:00

config_handlers.go

Fix storage/disk/backup disappearing for clusters with VerifySSL enabled

2025-11-08 23:07:49 +00:00

csrf_store.go

Fix critical P0 security and crash issues in API/WebSocket layer

2025-11-07 10:13:15 +00:00

demo_middleware.go

Fix demo mode to allow authentication endpoints

2025-11-06 13:48:28 +00:00

diagnostics.go

Fix diagnostics incorrectly warning about /run mount in Docker (related to #600 )

2025-11-09 16:49:49 +00:00

DO_NOT_EDIT_FRONTEND_HERE.md

Fix settings security tab navigation

2025-10-11 23:29:47 +00:00

docker_agents.go

Add custom display name support for Docker hosts

2025-11-05 23:18:03 +00:00

docker_metadata.go

Consolidate pending changes

2025-10-28 23:20:44 +00:00

frontend_embed.go

Improve static asset caching for hashed files

2025-11-06 13:54:26 +00:00

guest_metadata.go

Fix settings security tab navigation

2025-10-11 23:29:47 +00:00

host_agents_test.go

perf: reduce polling allocations and guest metadata load

2025-10-25 13:12:47 +00:00

host_agents.go

Improve host agent onboarding flow

2025-10-25 09:37:29 +00:00

http_metrics.go

feat: comprehensive diagnostics and observability improvements

2025-10-21 12:37:39 +00:00

middleware.go

feat: comprehensive diagnostics and observability improvements

2025-10-21 12:37:39 +00:00

notification_queue.go

Add comprehensive alert system reliability improvements

2025-11-06 16:46:30 +00:00

notifications.go

feat: Add configurable allowlist for webhook private IP targets (addresses #673 )

2025-11-09 08:31:12 +00:00

oidc_handlers.go

Fix settings security tab navigation

2025-10-11 23:29:47 +00:00

oidc_service.go

Fix P1: Resource leaks in Recovery Tokens, Rate Limiter, and OIDC Service

2025-11-07 10:18:44 +00:00

rate_limit_config_test.go

test: add X-RateLimit-Limit header regression test

2025-10-20 15:10:59 +00:00

rate_limit_config.go

Fix recurring update issues (related to #671 )

2025-11-11 09:09:30 +00:00

ratelimit.go

Fix P1: Resource leaks in Recovery Tokens, Rate Limiter, and OIDC Service

2025-11-07 10:18:44 +00:00

README.md

Fix settings security tab navigation

2025-10-11 23:29:47 +00:00

recovery_tokens.go

Fix P1: Resource leaks in Recovery Tokens, Rate Limiter, and OIDC Service

2025-11-07 10:18:44 +00:00

router_integration_test.go

Refactor: Code cleanup and localStorage consolidation

2025-11-04 21:50:46 +00:00

router.go

Security: Fix path traversal vulnerability in host-agent download endpoint

2025-11-12 16:27:11 +00:00

security_oidc.go

feat: add professional logging with runtime configuration and performance optimization

2025-10-20 15:13:38 +00:00

security_setup_fix_test.go

Refactor: Code cleanup and localStorage consolidation

2025-11-04 21:50:46 +00:00

security_setup_fix.go

Fix upgrade path when DISABLE_AUTH detected but no credentials exist (fixes #678 )

2025-11-09 20:33:58 +00:00

security_test.go

Refactor: Code cleanup and localStorage consolidation

2025-11-04 21:50:46 +00:00

security_tokens_test.go

Add API token scopes and standalone host agent

2025-10-23 11:40:31 +00:00

security_tokens.go

Refactor: Code cleanup and localStorage consolidation

2025-11-04 21:50:46 +00:00

security.go

Fix CSRF token validation and improve token management

2025-11-05 09:23:44 +00:00

session_store.go

Fix P1/P2 infrastructure issues: panic recovery and optimizations

2025-11-07 09:55:22 +00:00

system_settings.go

feat: Add configurable allowlist for webhook private IP targets (addresses #673 )

2025-11-09 08:31:12 +00:00

types.go

Add per-node temperature monitoring and fix critical config update bug

2025-11-05 14:11:53 +00:00

updates.go

Refactor update service to eliminate polling and race conditions

2025-11-11 09:33:05 +00:00

README.md

Internal API Package

This directory contains the API server implementation for Pulse.

Important Note About `frontend-modern/`

The frontend-modern/ subdirectory that appears here is:

AUTO-GENERATED during builds
NOT the source code - just a build artifact
IN .gitignore - never committed
REQUIRED BY GO - The embed directive needs it here

Frontend Development Location

👉 Edit frontend files at: /opt/pulse/frontend-modern/src/

Why This Structure?

Go's //go:embed directive has limitations:

Cannot use ../ paths to access parent directories
Cannot follow symbolic links
Must embed files within the Go module

This is a known Go limitation and our structure works around it.