fix: harden updater, SMTP, and gateway surfaces - #20
Merged
Conversation
Mitigate critical and medium security risks found during audit.\n\n- Switch GenFreeWin updater download from HTTP to HTTPS.\n- Remove hardcoded SMTP credentials, require environment-based secrets, and enforce TLS SMTP on port 587.\n- Restrict Fronius gateway CORS to known localhost browser origins.\n- Remove unauthenticated per-request host override from snapshot endpoints to eliminate SSRF vector.\n- Update gateway/browser READMEs to reflect hardened endpoint usage.\n\nKnown remaining risk: updater execution still lacks signature/hash verification and should be addressed in a follow-up hardening change.\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
ChristianRosewich
pushed a commit
that referenced
this pull request
Aug 12, 2026
Resolve the remaining CodeQL severity=error alerts that were reviewed in this pass. - Replace non-short-circuit boolean logic with short-circuit checks in GenFreeWin UI/view-model code. - Use whitespace-safe string guards for the affected conditionals. - Fix the Avalonia screen equality check to avoid reference-only comparison semantics. This commit continues the CodeQL remediation work for PR #20.
ChristianRosewich
pushed a commit
that referenced
this pull request
Aug 12, 2026
Broaden the CodeQL remediation pass to the next verified severity=error alerts across the repo. - Implement equality members for classes flagged by cs/class-missing-equals. - Correct invalid string formatting in the statistics and formatting examples. - Harden thread-safe access in JC-AMS station lookup/update paths. - Keep the existing security remediation branch moving toward a clean CodeQL run. This continues the CodeQL work for issue #20.
ChristianRosewich
pushed a commit
that referenced
this pull request
Aug 12, 2026
Address the next batch of CodeQL error alerts across GenFreeWin. - Replace remaining non-short-circuit boolean logic with short-circuit operators. - Preserve the intended learning example formatting string in TestStatements. - Continue the repo-wide CodeQL remediation work tracked by issue #20.
ChristianRosewich
pushed a commit
that referenced
this pull request
Aug 12, 2026
Address the next batch of CodeQL error alerts in the GenFreeWin print flow. - Replace the remaining non-short-circuit boolean checks with short-circuit operators. - Keep the explicit self-assignment in Anzeige as a documented learning exercise. - Continue the repo-wide CodeQL remediation work tracked by issue #20.
ChristianRosewich
pushed a commit
that referenced
this pull request
Aug 12, 2026
Address the next non-GenFreeWin CodeQL error alerts. - Mark unused computed values in the render demo as intentionally discarded. - Reduce precision-loss warnings in console display examples by using byte-range values. - Clean up unused collection output in AsteroidsModernEngine tests. - Preserve the ongoing CodeQL remediation trail for issue #20.
ChristianRosewich
pushed a commit
that referenced
this pull request
Aug 12, 2026
Address the next verified CodeQL alerts outside the previous batches. - Complete the custom draw operation equality implementation in the render demo. - Remove the explicit self-assignment that was already documented as a learning exercise. - Continue the issue #20 CodeQL remediation stream.
ChristianRosewich
pushed a commit
that referenced
this pull request
Aug 12, 2026
Address the next verified error-class CodeQL alerts across the broader repo. - Clamp color calculations in console demo code to avoid precision-loss issues. - Mark intentionally persistent collections as readonly and simplify test fixtures. - Replace a non-short-circuit loop guard and a bitwise XML writer flag check. - Continue the issue #20 CodeQL remediation stream.
ChristianRosewich
pushed a commit
that referenced
this pull request
Aug 12, 2026
Tidy the current warning-level CodeQL findings that were safe to address. - Remove an unused label in OrtsVerViewModel. - Reformat a ternary in the OleDb statement renderer. - Keep the alert remediation stream tied to issue #20.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
This PR addresses high-confidence security issues found during the repository audit. The current behavior allowed unsafe update and gateway flows, and exposed sensitive credential handling patterns.
What changed
Datenversandtand now load credentials from environment variables:GENPLUSWIN_SMTP_USERGENPLUSWIN_SMTP_PASSWORDhostoverride from gateway snapshot endpoints to eliminate the SSRF path.Notes for reviewers
A known residual risk remains in the updater flow: downloaded binaries are still executed without a signature/hash authenticity check. This should be addressed in a follow-up hardening PR.