Skip to content

fix(security): defense-in-depth hardening for plugin_syslog #303

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
TheWitness merged 5 commits into from
Apr 9, 2026
+53 −45
Merged

fix(security): defense-in-depth hardening for plugin_syslog #303

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
9603b08
ci: add CodeQL for javascript-typescript, python, ruby
somethingwithproof Mar 16, 2026
743ba74
fix(ci): use specific runner labels, fix codeql concurrency
somethingwithproof Mar 16, 2026
543e4c9
fix(security): defense-in-depth hardening for plugin_syslog
somethingwithproof Apr 9, 2026
b286476
security: replace legacy XML import with secure helper in plugin_syslog
somethingwithproof Apr 9, 2026
45936c4
Merge branch 'develop' into fix/defense-in-depth
TheWitness Apr 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
47 changes: 47 additions & 0 deletions .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,47 @@
name: "CodeQL"

on:
push:
branches: [main, master, develop, regression-audit]
paths-ignore:
- "**/*.php"
- "**/*.md"
pull_request:
branches: [main, master, develop, regression-audit]
paths-ignore:
- "**/*.php"
- "**/*.md"
schedule:
- cron: "30 1 * * 1"
workflow_dispatch:

concurrency:
group: codeql-${{ github.ref }}
cancel-in-progress: true

jobs:
analyze:
name: Analyze (${{ matrix.language }})
runs-on: ubuntu-latest
timeout-minutes: 20
permissions:
actions: read
contents: read
security-events: write
strategy:
fail-fast: false
matrix:
language: ["javascript-typescript", "python", "ruby"]
steps:
- name: Checkout repository
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
- name: Initialize CodeQL
uses: github/codeql-action/init@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3
with:
languages: ${{ matrix.language }}
- name: Autobuild
uses: github/codeql-action/autobuild@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3
with:
category: "/language:${{ matrix.language }}"
6 changes: 3 additions & 3 deletions syslog.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1191,7 +1191,7 @@ function syslog_filter($sql_where, $tab) {
<?php print __('From', 'syslog');?>
</td>
<td>
<input type='text' id='date1' size='18' value='<?php print get_request_var('date1');?>'>
<input type='text' id='date1' size='18' value='<?php print html_escape_request_var('date1'); ?>'>
</td>
<td>
<i title='<?php print __esc('Start Date Selector', 'syslog');?>' class='calendar fa fa-calendar-alt' id='startDate'></i>
Expand All @@ -1200,7 +1200,7 @@ function syslog_filter($sql_where, $tab) {
<?php print __('To', 'syslog');?>
</td>
<td>
<input type='text' id='date2' size='18' value='<?php print get_request_var('date2');?>'>
<input type='text' id='date2' size='18' value='<?php print html_escape_request_var('date2'); ?>'>
</td>
<td>
<i title='<?php print __esc('End Date Selector', 'syslog');?>' class='calendar fa fa-calendar-alt' id='endDate'></i>
Expand Down Expand Up @@ -1472,7 +1472,7 @@ function syslog_filter($sql_where, $tab) {
</select>
</td>
<?php } else { ?>
<input type='hidden' id='removal' value='<?php print get_request_var('removal');?>'>
<input type='hidden' id='removal' value='<?php print html_escape_request_var('removal'); ?>'>
<?php } ?>
<?php if (get_nfilter_request_var('tab') == 'syslog') { ?>
<td>
Expand Down
15 changes: 1 addition & 14 deletions syslog_alerts.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -934,20 +934,7 @@ function import() {
}

function alert_import() {
$import_text = get_nfilter_request_var('import_text');

if (trim($import_text) != '') {
/* textbox input */
$xml_data = $import_text;
} elseif (($_FILES['import_file']['tmp_name'] != 'none') && ($_FILES['import_file']['tmp_name'] != '')) {
/* file upload */
$fp = fopen($_FILES['import_file']['tmp_name'],'r');
$xml_data = fread($fp, filesize($_FILES['import_file']['tmp_name']));
fclose($fp);
} else {
header('Location: syslog_alerts.php?header=false');
exit;
}
$xml_data = syslog_get_import_xml_payload('syslog_alerts.php?header=false');

$xml_array = xml2array($xml_data);

Expand Down
15 changes: 1 addition & 14 deletions syslog_removal.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -731,20 +731,7 @@ function import() {
}

function removal_import() {
$import_text = get_nfilter_request_var('import_text');

if (trim($import_text) != '') {
/* textbox input */
$xml_data = $import_text;
} elseif (($_FILES['import_file']['tmp_name'] != 'none') && ($_FILES['import_file']['tmp_name'] != '')) {
/* file upload */
$fp = fopen($_FILES['import_file']['tmp_name'],'r');
$xml_data = fread($fp, filesize($_FILES['import_file']['tmp_name']));
fclose($fp);
} else {
header('Location: syslog_removal.php?header=false');
exit;
}
$xml_data = syslog_get_import_xml_payload('syslog_removal.php?header=false');

/* obtain debug information if it's set */
$xml_array = xml2array($xml_data);
Expand Down
15 changes: 1 addition & 14 deletions syslog_reports.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -796,20 +796,7 @@ function import() {
}

function report_import() {
$import_text = get_nfilter_request_var('import_text');

if (trim($import_text) != '') {
/* textbox input */
$xml_data = $import_text;
} elseif (($_FILES['import_file']['tmp_name'] != 'none') && ($_FILES['import_file']['tmp_name'] != '')) {
/* file upload */
$fp = fopen($_FILES['import_file']['tmp_name'],'r');
$xml_data = fread($fp, filesize($_FILES['import_file']['tmp_name']));
fclose($fp);
} else {
header('Location: syslog_reports.php?header=false');
exit;
}
$xml_data = syslog_get_import_xml_payload('syslog_reports.php?header=false');

/* obtain debug information if it's set */
$xml_array = xml2array($xml_data);
Expand Down
Loading