fix(security): defense-in-depth hardening for plugin_wmi#9
fix(security): defense-in-depth hardening for plugin_wmi#9somethingwithproof wants to merge 2 commits intoCacti:developfrom
Conversation
Automated fixes: - XSS: escape request variables in HTML value attributes - SQLi: convert string-concat queries to prepared statements - Deserialization: add allowed_classes=>false - Temp files: replace rand() with tempnam() Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
There was a problem hiding this comment.
Pull request overview
Hardens the plugin_wmi Linux WMI implementation against PHP object injection by restricting unserialize() to disallow classes when decoding stored account credentials.
Changes:
- Add
allowed_classes => falsetounserialize()in credential decode path.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| $info = base64_decode($info); | ||
| $info = unserialize($info); | ||
| $info = unserialize($info, array('allowed_classes' => false)); | ||
| $info = $info['password']; |
There was a problem hiding this comment.
unserialize() (even with allowed_classes => false) and base64_decode() can return false on malformed/corrupt data. Immediately indexing $info['password'] will raise warnings/notices and may break authentication flow. Consider validating that the decoded/unserialized value is an array with the expected key (and returning a safe failure / setting $this->error) when decoding fails.
- Change Dependabot ecosystem from npm to composer (PHP-only repo) - Remove PHP from CodeQL paths-ignore so security PRs get analysis - Remove committed .omc session artifacts, add .omc/ to .gitignore Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
|
Converted to draft to serialize the stack in this repo. Blocked by #8; will un-draft after that merges to avoid cross-PR merge conflicts. |
Summary
Defense-in-depth hardening addressing 31 security audit findings.
html_escape_request_var()allowed_classes => falsetounserialize()All changes PHP 7.0+ compatible.
Test plan