danvics/Pulse
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
Pulse/internal
History
rcourtman 71abcb2a37 fix: harden SSH config endpoint per Codex security review 
Addressed security concerns identified by Codex code review:

1. **Memory exhaustion protection**
   - Added http.MaxBytesReader with 32KB limit
   - Prevents malicious large POST from killing server

2. **Dangerous directive blocking**
   - Reject ProxyCommand, LocalCommand, RemoteCommand
   - Prevents command injection via SSH config

3. **Improved error handling**
   - Check all error returns properly
   - Return 5xx on failures
   - Log file size and path for debugging

4. **Scoped SSH config (critical fix)**
   - Changed from `Host *` to specific cluster nodes
   - Prevents overriding ALL SSH connections
   - Only affects Proxmox nodes for temperature monitoring
   - Preserves other SSH functionality (git, etc.)

Before: Host * broke all SSH connections from Pulse
After: Only Proxmox cluster nodes use ProxyJump

Credit: Codex code review identified these issues
2025-10-18 23:21:59 +00:00
..
adapters Fix settings security tab navigation 2025-10-11 23:29:47 +00:00
alerts Adjust backup and snapshot alert handling 2025-10-18 20:11:01 +00:00
api fix: harden SSH config endpoint per Codex security review 2025-10-18 23:21:59 +00:00
auth Fix settings security tab navigation 2025-10-11 23:29:47 +00:00
config Adjust backup and snapshot alert handling 2025-10-18 20:11:01 +00:00
crypto Fix settings security tab navigation 2025-10-11 23:29:47 +00:00
discovery fix: improve discovery performance and reliability 2025-10-18 22:59:40 +00:00
dockeragent Docker agent: add arch-aware self-update download 2025-10-16 08:43:59 +00:00
errors Fix settings security tab navigation 2025-10-11 23:29:47 +00:00
interfaces Fix settings security tab navigation 2025-10-11 23:29:47 +00:00
mock Adjust backup and snapshot alert handling 2025-10-18 20:11:01 +00:00
models Adjust backup and snapshot alert handling 2025-10-18 20:11:01 +00:00
monitoring Adjust backup and snapshot alert handling 2025-10-18 20:11:01 +00:00
notifications Add Apprise notification integration (#570) 2025-10-18 16:39:39 +00:00
tempproxy feat: add comprehensive node cleanup system 2025-10-17 18:53:45 +00:00
types Fix settings security tab navigation 2025-10-11 23:29:47 +00:00
updates chore: bump version to v4.24.0 2025-10-15 22:26:24 +00:00
utils Fix settings security tab navigation 2025-10-11 23:29:47 +00:00
websocket Fix settings security tab navigation 2025-10-11 23:29:47 +00:00