Repository navigation
Fix code-scanning alerts and the NuGet audit failure that keeps CI red - #23
Merged
Merged
Conversation
Restore fails on main because TreatWarningsAsErrors turns the NU1902 and NU1903 audit warnings into errors: - Microsoft.SourceLink.GitHub 8.0.0 brings in Microsoft.Build.Tasks.Git 8.0.0 (GHSA-23fw-v26w-5fgq), which has no patched 8.x release. Move to 10.0.402. - Testcontainers 4.1.0 brings in SSH.NET 2024.1.0 (GHSA-q939-rpr3-3284, GHSA-mggc-4xg6-vcxf). Pin the transitive package to 2026.0.0, the first patched release, through central transitive pinning. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The Settings page persisted the whole settings object, API key included, to localStorage (CodeQL js/clear-text-storage-of-sensitive-data). Persist only the API base URL and refresh interval. The key now lives in memory for the life of the page, with the build-time VITE_API_KEY as the fallback, and is read when a request is made. A key saved to localStorage by an earlier build is scrubbed the first time the settings are read. The SignalR access token factory reads the key at call time so a key entered on the Settings page applies on the next (re)connect. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The topic and queue creation log lines wrote request values straight into the log entry (CodeQL cs/log-forging), so a name containing CR/LF could forge extra log lines. Route them through LogSanitizer, which strips CR, LF, every other control character and the Unicode line and paragraph separators, and caps the value at 256 characters. Covered by unit tests in the integration test project, which now references the management API and sees its internals. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Fixes the serious open code-scanning alerts and the restore failure that has kept CI red since the workflows were re-enabled.
Microsoft.SourceLink.GitHub8.0.0 -> 10.0.402 (itsMicrosoft.Build.Tasks.Git8.0.0 is flagged by GHSA-23fw-v26w-5fgq and has no patched 8.x).SSH.NET, which arrives through Testcontainers 4.1.0, is pinned to 2026.0.0 through central transitive pinning (GHSA-q939-rpr3-3284, GHSA-mggc-4xg6-vcxf).js/clear-text-storage-of-sensitive-data(dashboard/src/services/api.ts). The Settings page persisted the whole settings object, API key included, tolocalStorage. Only the API base URL and refresh interval are persisted now. The key is kept in memory for the page's lifetime (the build-timeVITE_API_KEYis the fallback, read when a request is made), and a key saved by an earlier build is scrubbed fromlocalStorageon first read. The SignalR access token factory reads the key at call time.cs/log-forging(MeshObservationService.cs). The topic and queue creation log lines now pass request values throughLogSanitizer.Sanitize, which strips CR/LF, other control characters and the Unicode line/paragraph separators and caps the value at 256 characters. Unit tests cover it.Notes for reviewers
VITE_API_KEYis inlined into the public JS bundle by Vite, so it should not hold a production secret. Not changed here.EventMesh.Management.Api(withInternalsVisibleTo) so the sanitizer can be unit tested.Checked locally
dotnet build EventMesh.slnx -c Release: 0 warnings, 0 errors.dotnet testfor Abstractions, Core and Integration test projects: 11 + 28 + 31 passed (the Compatibility tests need Docker brokers and are left to CI).dotnet format EventMesh.slnx --verify-no-changes: clean. TODO/FIXME scan: clean.cd dashboard && npm ci && npm run build: succeeds.🤖 Generated with Claude Code