CCCHH/sunders
CCCHH/sunders
Watch
3
0
Fork
You've already forked sunders
 1
forked from kamba4/sunders
Code Issues 6 Pull requests Packages 1 Activity Actions

Fix security issues #38

Merged
stb merged 11 commits from security-fixes into main 2026-11-15 13:42:03 +01:00
Conversation 0 Commits 11 Files changed 7 +160 -107
stb commented 2026-11-15 11:42:46 +01:00
Owner
  • Corrects country code check in statistics filter
  • Escapes generated SQL and validates sequence number
  • Publishes images only from main
  • Hardens web container
  • Escapes location search results
  • Escapes OSM tag data in camera popups
* Corrects country code check in statistics filter * Escapes generated SQL and validates sequence number * Publishes images only from main * Hardens web container * Escapes location search results * Escapes OSM tag data in camera popups
camera.php built its JSON by hand with htmlentities(), which leaves
backslashes intact, and the client parsed it with eval() and inserted tag
values into the popup as HTML. A tag value such as <img ...> therefore
became live markup (stored XSS for anyone able to edit OSM data), and a lone
backslash broke parsing of the whole response.

- camera.php now builds the response with json_encode() and returns raw values
- tags named lat, lon, id, count, multi or poly no longer override the
  fields set by the server
- error responses no longer include database error messages
- the client uses JSON.parse() and escapes all keys and values; only
  http(s) URLs are rendered as links/images
Nominatim results were inserted via innerHTML and loaded as a JSONP script
with an unencoded query. Results are now fetched as JSON, the query is URL
encoded, text is escaped and coordinates must be numeric.
- document root is owned by root and not writable by www-data
  (the base image ships /var/www/html as www-data with mode 1777)
- uses php.ini-production, so errors are not shown to clients
- disables directory listings, expose_php and the detailed server signature
Every pushed ref built and pushed images, with the tag derived from the ref
name. A branch named "latest" or a git tag named "main" therefore
overwrote the production image, and ref names were interpolated into shell
scripts unquoted (script injection).

- images are only pushed for pushes to refs/heads/main
- other refs are built and tested with a ci-<sha> tag, never pushed
- registry login happens only when publishing, after the compose test
- main additionally pushes an immutable sha-<sha> tag for pinning
- expression values are passed to scripts via env

The registry credentials still need to be restricted to main on the
Forgejo side, since a pushed branch can modify this workflow.
create_camera_update_statements.php wrote OSM tag keys and values unescaped
into /migrations/*.sql. Values are now escaped and node ids cast to int.
The sequence number argument must be numeric and is bound as a parameter
instead of being concatenated into SQL and the output path.
fix: Corrects country code check in statistics filter
Some checks failed
Build (and tag) Images / build (push) Failing after 12s
Details
cdf90a04d3 
Operator precedence made the check always true; it now accepts two capital letters or '--' as intended.
Merge remote-tracking branch 'origin/main' into security-fixes
Some checks failed
Build (and tag) Images / build (push) Has been cancelled
Details
3211e0f355
fix: Builds images with kaniko
All checks were successful
Build (and tag) Images / build (push) Successful in 1m23s
Details
6ec1b9fc5a 
There are no Windows runners; build the images with kaniko in a container
on the `docker` runner, as on the link-updates branch, while keeping the
publishing restrictions:

- only pushes to refs/heads/main publish, as `latest` and `sha-<commit>`
- other refs build with --no-push under a ci-<commit> tag
- registry credentials are only passed to the build when publishing

The docker compose smoke test is dropped, as there is no Docker daemon
inside the kaniko container.
chore: Reverts workflow changes
Some checks failed
Build (and tag) Images / build (push) Has been cancelled
Details
46b7509c37 
The image build workflow is handled separately in the kaniko-build branch;
this pull request no longer changes it.
Merge branch 'main' into security-fixes
All checks were successful
Build (and tag) Images / Build data_handler Image (push) Successful in 40s
Details
Build (and tag) Images / Build web Image (push) Successful in 1m2s
Details
bef369d002
Merge branch 'main' into security-fixes
All checks were successful
Build (and tag) Images / Build data_handler Image (push) Successful in 42s
Details
Build (and tag) Images / Build web Image (push) Successful in 57s
Details
2b47d340c3
stb merged commit 60694442c2 into main 2026-11-15 13:42:03 +01:00
stb deleted branch security-fixes 2026-11-15 13:42:04 +01:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
ViMaSter
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
CCCHH/sunders!38
No description provided.