fix(security): defense-in-depth hardening for plugin_webseer - #66
fix(security): defense-in-depth hardening for plugin_webseer#66somethingwithproof wants to merge 7 commits into
Conversation
There was a problem hiding this comment.
Pull request overview
This PR aims to harden plugin_webseer against deserialization attacks by restricting classes during unserialize() of remote data.
Changes:
- Updates server list refresh to add an
allowed_classesrestriction during deserialization. - Updates URL list refresh to add an
allowed_classesrestriction during deserialization.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
Converted to draft to serialize the stack in this repo. Blocked by #65; will un-draft after that merges to avoid cross-PR merge conflicts. |
Automated fixes: - XSS: escape request variables in HTML value attributes - SQLi: convert string-concat queries to prepared statements - Deserialization: add allowed_classes=>false - Temp files: replace rand() with tempnam() Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Replace .click(fn) with .on('click', fn), .change(fn) with
.on('change', fn), .submit(fn) with .on('submit', fn), .unbind()
with .off(), and .resize(fn) with .on('resize', fn).
These shorthands were deprecated in jQuery 3.3 and will be removed
in jQuery 4.0. Cacti core ships jQuery 3.x on develop.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
The options array was mistakenly passed as the second arg to base64_decode(), where it is interpreted as the boolean $strict parameter. The allowed_classes restriction is never applied. Move the options array to the second arg of unserialize(). Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
- Use strict mode for base64_decode - Check decoded result before unserialize - Suppress unserialize warnings with @ and check is_array - Log and break on any failure Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
- Change Dependabot ecosystem from npm to composer (PHP-only repo) - Remove PHP from CodeQL paths-ignore so security PRs get analysis - Remove committed .omc session artifacts, add .omc/ to .gitignore Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
a48c39d to
75252de
Compare
|
The security-critical part here, hardening the unserialize of remote refresh responses with allowed_classes => false, is already in #65 (includes/functions.php, both refresh paths), together with strict base64_decode. #65's isset($servers[0]['id']) guard already makes a malformed response a no-op. What's left in this branch is optional logging/type-guard robustness, not a security gap, so I'm closing this to keep the webseer review down to one hardening PR (#65) plus the pre-auth fix (#71). Happy to add the extra bail-out logging as a small follow-up if wanted. |
Summary
Defense-in-depth hardening addressing 26 security audit findings.
html_escape_request_var()allowed_classes => falsetounserialize()All changes PHP 7.0+ compatible.
Test plan