mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-09-10 02:25:56 +00:00
rcourtman
9615b5f2b0
Resolves every open code scanning alert on the repository. Dependabot and secret scanning were already clear. SMART temperature truncation (alerts 312, 313). parseRawValue returns a 64-bit raw attribute value, but DiskSMART.Temperature is an int, which is 32 bits wide on the 386 and arm release builds Pulse ships. The range check ran after the narrowing conversion, so a raw value of 4294967316 truncated to 20 and was published as a plausible 20 degree reading. validSMARTTemperature64 now gates the conversion. Provider MSP restore archive names (alert 314). cleanProviderMSPArchiveName rejected a leading "../" but not a bare "..", which path.Clean produces from entries such as ".." and "a/../..". pathIsInside caught the escape downstream, so this was not exploitable, but the sanitizer now rejects it outright instead of depending on a second gate. TrueNAS device paths (alert 315). vdev.Device is supplied by the appliance, concatenated into a path and published verbatim on ZFSDevice.Path, so values like "//evil.example.com/share" and "/\evil.example.com" passed straight through. devicePath now drops traversal segments and backslashes and collapses a leading double slash. The alert's open-redirect framing does not apply here, there is no redirect sink on this path, but the value is untrusted input rendered as a path and is worth normalising. Patrol readiness cache key (alert 311). The key is persisted to ai_patrol_model_readiness.json and embedded an unkeyed SHA-256 of the Ollama Basic Auth username and password. That password is chosen by a human, so anyone holding the evidence file could recover it offline at two SHA-256 operations per guess. The fingerprint is now HMAC-SHA256 keyed with a 32-byte per-install salt stored beside the evidence at mode 600. Credential rotation still invalidates the cache and the key still survives a restart. Each fix carries a regression test confirmed to fail against the previous implementation. monitoring.md carries the one warranted contract refinement. It already required SMART temperature selection to accept only plausible readings, and that rule now states the width at which plausibility is decided. Contract-Neutral: CodeQL security fixes with no public-contract delta and no payload change. monitoring.md carries the one warranted refinement (SMART plausibility decided at 64-bit width). Residual demands are inapplicable: ai-runtime readiness prose documents interruption semantics, not cache-key derivation, and the credential-invalidation contract is unchanged; cloud-paid and deployment-installability contracts never name archive-entry sanitisation; agent-lifecycle owns smartctl.go but its SMART temperature prose lives in the staged monitoring.md.