09186e23b9
Some checks failed
Backend Tests / pytest (Python 3.12) (push) Has been cancelled
Deploy to Production / backend-tests (push) Has been cancelled
Deploy to Production / frontend-build (push) Has been cancelled
Frontend Checks / Build & typecheck (push) Has been cancelled
SonarCloud / SonarCloud Analysis (push) Has been cancelled
Deploy to Production / Trigger production update (push) Has been cancelled
Security - Enforce guest ownership and server assignment across Proxmox endpoints (VM/LXC actions, firewall, backups, tasks, bulk operations, deploy, LXC/ISO creation, golden template) and WebSocket channels - Keep the panel's PVE root ticket server-side for consoles; single-use WebSocket tickets instead of the JWT in URLs; re-check access on open WebSocket bridges - Validate identifiers that reach Proxmox API paths and node shell commands; reject backup archives / foreign volumes in create requests - Close privilege escalation in user management, TOTP replay, reset-link poisoning, X-Forwarded-For spoofing, stored XSS (group icons, SVG logos) - SSH host key pinning (TOFU), encrypted 2FA seeds and notification secrets, password changes end other sessions, redact secrets in logs - Quotas count in-flight creations; 2FA failures count toward lockout Fixes - Consoles on non-default API ports, large App Store/script files, interrupted tasks after restart, impersonation lost on token refresh, HTTPExceptions swallowed into 500s, WebSocket client reconnects Performance and process - Fewer DB writes and queries on hot paths, lazy-loaded locales and heavy pages, off-loop blocking work, indexes (migrations 44-46) - Deploy waits for backend tests and frontend build; frontend checks workflow; API bound to loopback without the SSL profile
22 lines
824 B
Python
22 lines
824 B
Python
"""Query-string secrets of WebSocket URLs must not reach the logs."""
|
|
import logging
|
|
|
|
from app.main import _RedactSecretsFilter, _redact_secrets
|
|
|
|
|
|
def test_ws_tokens_are_redacted():
|
|
line = '1.2.3.4:5 - "WebSocket /proxmox/ws/vnc/1/pve/qemu/100?port=5900&vncticket=PVEVNC:abc&auth_ticket=h1&token=eyJ.x.y" [accepted]'
|
|
|
|
out = _redact_secrets(line)
|
|
|
|
assert "eyJ.x.y" not in out and "PVEVNC:abc" not in out and "h1" not in out
|
|
assert "port=5900" in out and "token=***" in out
|
|
|
|
|
|
def test_filter_rewrites_uvicorn_records():
|
|
record = logging.LogRecord("uvicorn.error", logging.INFO, __file__, 1,
|
|
'%s - "WebSocket %s" [accepted]', ("1.2.3.4", "/ws/tasks?token=secret"), None)
|
|
|
|
assert _RedactSecretsFilter().filter(record) is True
|
|
assert "secret" not in record.getMessage()
|