mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-08-04 16:07:55 +00:00
Anso
0ba09ebdee
* chore: bump brace-expansion and fast-uri via npm audit fix Resolves GHSA-rgw5-rvv9-x895 (brace-expansion DoS via unbounded intermediate arrays). Both transitive dev dependencies updated: - brace-expansion 5.0.8 -> 5.0.9 - fast-uri 3.1.4 -> 3.1.5 * chore: also bump frontend deps via npm audit fix Fixes brace-expansion and postcss in the frontend lockfile so npm audit --audit-level=high passes on both packages. * chore: bump ip-address transitive dep via npm audit fix Resolves three new ip-address advisories (GHSA-mwp4-54f8-5fhr, GHSA-4xrf-jv44-h6hh, GHSA-22jq-vg5j-6vgg) published between prior push and CI run. * feat: add ntfy notification channel Add ntfy (https://ntfy.sh) as the fifth notification channel alongside Discord, Slack, Webhook, and Apprise. ntfy speaks its native protocol: plain-text POST body with Content-Type, Title, Priority, and Tags headers. Priority maps info/warning/error to ntfy's default/high/urgent. URL validation allows both HTTP and HTTPS (common for LAN self-hosting) but rejects embedded credentials, consistent with Apprise. Token auth via ntfy's documented ?auth= query parameter is supported. * fix: correct ntfy channel test cases for Linux URL parsing and required type field - notification-channels.test.ts: replace http:///topic host check with a cross-platform invalid-URL case (WHATWG parser treats triple-slash authority differently on Linux vs Windows) - ConfigurationStatus.test.tsx: add ntfy agent slot to makePayload and inline agents fixtures (required by the expanded ConfigurationAgents type) * fix: remove unused import and update 0/4 masthead assertions to 0/5 * ci: exclude NotificationService.ts from js/request-forgery CodeQL rule Notification channel dispatch methods (Discord, Slack, Webhook, Apprise, ntfy) all call fetch() with admin-configured URLs and notification bodies that may embed stack or path data. This matches the trust model already documented for registry-api.ts: single-tenant self-hosted, admin owns the server, outbound posting is the intended behavior. The write path is gated by requireAdmin or requirePermission(node:manage), and every dispatch runs with a 10s AbortSignal.timeout. * ci: also exclude NotificationService.ts from js/file-access-to-http Notification messages may embed stack names, paths, or compose-derived content. Same trust model as js/request-forgery: admin owns the server and the configured endpoints, write path is gated. * fix: correct ntfy channel tab copy and validation error message The ntfy settings tab was reusing the generic webhook label, helper, and placeholder (Webhook URL / JSON payloads / https://...). Give ntfy its own copy: label names the server-and-topic URL, helper states plain-text delivery and the mandatory topic path, placeholder matches the routing section. Also fix the routing-rule validation toast: the guard correctly exempts ntfy from the HTTPS check but the error message was not updated alongside it, so ntfy URLs received a misleading HTTPS-required message. * fix: strip trailing slash from ntfy topic URL before dispatch A topic URL like https://ntfy.sh/mytopic/ validates fine (the check strips the trailing slash internally) but was stored and dispatched with the slash intact, causing the real ntfy server to 404. Normalize before fetch so the request reaches the correct topic path. Also add ntfy to the Channels card description in the settings registry.
71 lines
3.6 KiB
YAML
71 lines
3.6 KiB
YAML
data_extensions:
|
|
- .github/codeql/extensions/safeLog.model.yml
|
|
|
|
# End-to-end Playwright specs are test-harness code, not shipped product code.
|
|
# They seed fixture files directly into the backend's COMPOSE_DIR (a fixed path
|
|
# under /tmp: both the spec fallback and the CI start-app default are
|
|
# /tmp/compose) so the API under test can read them back, which CodeQL flags as
|
|
# js/insecure-temporary-file. A randomized mkdtemp does not apply: the backend
|
|
# resolves paths against its own COMPOSE_DIR, so a fixture written elsewhere
|
|
# would be invisible to it, and the predictable-temp-path threat is moot on the
|
|
# ephemeral, single-tenant CI runners. paths-ignore is used (not a query-filters
|
|
# entry) because only paths-ignore scopes analysis by source path; a paths key
|
|
# inside a query-filters exclude is ignored, since query-filters match on query
|
|
# metadata rather than file location.
|
|
paths-ignore:
|
|
- e2e/**
|
|
|
|
query-filters:
|
|
# API tokens are 256-bit CSPRNG random; sha256 of the raw token is the
|
|
# correct construction. js/insufficient-password-hash exists to catch weak
|
|
# hashing of low-entropy human passwords, which is irrelevant for these
|
|
# high-entropy opaque keys. Scoped to the token-handling files only, so
|
|
# real user-password code (bcrypt-hashed elsewhere) is still analyzed.
|
|
- exclude:
|
|
id: js/insufficient-password-hash
|
|
paths:
|
|
- backend/src/utils/apiTokenFormat.ts
|
|
- backend/src/routes/apiTokens.ts
|
|
- backend/src/__tests__/**
|
|
|
|
# registry-api.ts resolves image references parsed from admin-controlled
|
|
# compose files into Docker registry manifest URLs. CodeQL traces the file
|
|
# data into the outbound HTTPS request and flags it as a request-forgery
|
|
# risk. Sencho is single-tenant and self-hosted: the admin who writes the
|
|
# compose files owns the server, and specifying arbitrary registries is the
|
|
# intended behavior. probeManifestForRef guards against URL-injection
|
|
# characters in tag/repo components before constructing the URL; the
|
|
# remaining taint path is inherent to the product's design rather than a
|
|
# vulnerability. Excluding this file so the query still catches real SSRF
|
|
# from untrusted multi-tenant or external input elsewhere.
|
|
- exclude:
|
|
id: js/request-forgery
|
|
paths:
|
|
- backend/src/services/registry-api.ts
|
|
|
|
# NotificationService dispatches alerts to admin-configured channel
|
|
# endpoints (Discord, Slack, Webhook, Apprise, ntfy). CodeQL traces the
|
|
# admin-provided URL and the notification body (which may embed stack or
|
|
# path data) into the outbound fetch() and flags it as a request-forgery
|
|
# risk. Sencho is single-tenant and self-hosted: the admin who configures
|
|
# the channel URLs owns the server, and posting notifications to those
|
|
# endpoints is the intended behavior. The write path is gated by
|
|
# requireAdmin (routes) or requirePermission(node:manage) (agents), and
|
|
# every dispatch runs with a 10s AbortSignal.timeout. Excluding the
|
|
# notification channel dispatch methods so the query still catches real
|
|
# SSRF from untrusted multi-tenant or external input elsewhere.
|
|
- exclude:
|
|
id: js/request-forgery
|
|
paths:
|
|
- backend/src/services/NotificationService.ts
|
|
|
|
# Same NotificationService trust-model exclusion for file data reaching
|
|
# the outbound fetch() (js/file-access-to-http). Notification messages
|
|
# may embed stack names, paths, or compose-derived content. The admin
|
|
# owns the server and the configured endpoints; the 10s timeout and
|
|
# admin-only write gates are the same compensating controls as above.
|
|
- exclude:
|
|
id: js/file-access-to-http
|
|
paths:
|
|
- backend/src/services/NotificationService.ts
|