fix errors - #785
Merged
Merged
Conversation
Mitigate critical and medium security risks found during audit.\n\n- Switch GenFreeWin updater download from HTTP to HTTPS.\n- Remove hardcoded SMTP credentials, require environment-based secrets, and enforce TLS SMTP on port 587.\n- Restrict Fronius gateway CORS to known localhost browser origins.\n- Remove unauthenticated per-request host override from snapshot endpoints to eliminate SSRF vector.\n- Update gateway/browser READMEs to reflect hardened endpoint usage.\n\nKnown remaining risk: updater execution still lacks signature/hash verification and should be addressed in a follow-up hardening change.\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
…ity-audit-fixes fix: harden updater, SMTP, and gateway surfaces
Resolve the remaining CodeQL severity=error alerts that were reviewed in this pass. - Replace non-short-circuit boolean logic with short-circuit checks in GenFreeWin UI/view-model code. - Use whitespace-safe string guards for the affected conditionals. - Fix the Avalonia screen equality check to avoid reference-only comparison semantics. This commit continues the CodeQL remediation work for PR #20.
Broaden the CodeQL remediation pass to the next verified severity=error alerts across the repo. - Implement equality members for classes flagged by cs/class-missing-equals. - Correct invalid string formatting in the statistics and formatting examples. - Harden thread-safe access in JC-AMS station lookup/update paths. - Keep the existing security remediation branch moving toward a clean CodeQL run. This continues the CodeQL work for issue #20.
Address the next batch of CodeQL error alerts across GenFreeWin. - Replace remaining non-short-circuit boolean logic with short-circuit operators. - Preserve the intended learning example formatting string in TestStatements. - Continue the repo-wide CodeQL remediation work tracked by issue #20.
Address the next batch of CodeQL error alerts in the GenFreeWin print flow. - Replace the remaining non-short-circuit boolean checks with short-circuit operators. - Keep the explicit self-assignment in Anzeige as a documented learning exercise. - Continue the repo-wide CodeQL remediation work tracked by issue #20.
Address the next non-GenFreeWin CodeQL error alerts. - Mark unused computed values in the render demo as intentionally discarded. - Reduce precision-loss warnings in console display examples by using byte-range values. - Clean up unused collection output in AsteroidsModernEngine tests. - Preserve the ongoing CodeQL remediation trail for issue #20.
Address the next verified CodeQL alerts outside the previous batches. - Complete the custom draw operation equality implementation in the render demo. - Remove the explicit self-assignment that was already documented as a learning exercise. - Continue the issue #20 CodeQL remediation stream.
Address the next verified error-class CodeQL alerts across the broader repo. - Clamp color calculations in console demo code to avoid precision-loss issues. - Mark intentionally persistent collections as readonly and simplify test fixtures. - Replace a non-short-circuit loop guard and a bitwise XML writer flag check. - Continue the issue #20 CodeQL remediation stream.
…ity-audit-fixes Christianrosewich security audit fixes
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.