rcourtman 946e2e455f Security: Fix path traversal vulnerability in host-agent download endpoint ...

CRITICAL SECURITY FIX: The /download/pulse-host-agent endpoint was directly
concatenating user-supplied platform and arch query parameters into file paths
without validation, allowing path traversal attacks.

An attacker could request:
  /download/pulse-host-agent?platform=../../etc/passwd
to read arbitrary files from the container filesystem.

Fix: Add input validation to only allow alphanumeric characters and hyphens
in platform/arch parameters before using them in file paths.

Related: Codex security audit identified this during pre-release review

2025-11-12 16:27:11 +00:00

..

alerts

feat: Add mdadm RAID monitoring support for host agents

2025-11-09 16:36:33 +00:00

api

Security: Fix path traversal vulnerability in host-agent download endpoint

2025-11-12 16:27:11 +00:00

auth

Fix config backup/restore by enforcing 12-char minimum password (related to #646)

2025-11-07 22:51:55 +00:00

config

Make api_tokens.json authoritative source for API tokens (fixes #685)

2025-11-11 00:17:40 +00:00

crypto

Harden setup token flow and enforce encrypted persistence

2025-10-25 16:00:37 +00:00

discovery

Fix discovery test Prometheus metric collision

2025-11-11 23:34:49 +00:00

dockeragent

Fix critical version embedding issues for 4.26 release

2025-11-06 11:42:52 +00:00

errors

Fix settings security tab navigation

2025-10-11 23:29:47 +00:00

hostagent

feat: Add mdadm RAID monitoring support for host agents

2025-11-09 16:36:33 +00:00

hostmetrics

Filter read-only filesystems from host agent disk metrics (related to #690)

2025-11-12 09:47:02 +00:00

logging

feat: comprehensive diagnostics and observability improvements

2025-10-21 12:37:39 +00:00

mdadm

feat: Add mdadm RAID monitoring support for host agents

2025-11-09 16:36:33 +00:00

metrics

Add comprehensive alert system reliability improvements

2025-11-06 16:46:30 +00:00

mock

Refactor: Code cleanup and localStorage consolidation

2025-11-04 21:50:46 +00:00

models

feat: Add mdadm RAID monitoring support for host agents

2025-11-09 16:36:33 +00:00

monitoring

Filter read-only filesystems from host agent disk metrics (related to #690)

2025-11-12 09:47:02 +00:00

notifications

Fix notification manager deadlock in Stop()

2025-11-11 23:58:18 +00:00

sensors

feat: Add temperature collection to pulse-host-agent (related to #661)

2025-11-07 22:54:40 +00:00

ssh/knownhosts

feat(security): Add SSH output limits and improve host key management

2025-11-07 17:09:02 +00:00

system

Enhance container detection for temperature SSH safeguards (refs #601)

2025-11-04 22:30:35 +00:00

tempproxy

Fix temperature data intermittency caused by proxy rate limit retries

2025-11-05 10:20:15 +00:00

types

Fix settings security tab navigation

2025-10-11 23:29:47 +00:00

updates

Fix: Skip draft releases in update checker

2025-11-12 12:31:58 +00:00

utils

Refactor: Code cleanup and localStorage consolidation

2025-11-04 21:50:46 +00:00

websocket

Fix P1: Add shutdown mechanism to WebSocket Hub

2025-11-07 10:20:26 +00:00