bambuddy

vinez/bambuddy

Fork 0

mirror of https://github.com/maziggy/bambuddy.git synced 2026-08-11 00:30:12 -04:00

Commit graph

Author	SHA1	Message	Date
maziggy	598cc699d4	Add CodeQL query suites for zero-finding scans and fix remaining security issues - Create .codeql/python-bambuddy.qls excluding 14 accepted-risk rule categories (all reviewed and documented with justifications) - Create .codeql/javascript-bambuddy.qls excluding false-positive XSS findings (generated coverage file + blob URL in audio src) - Fix stack trace exposure in updates.py: replace str(e) with generic error messages in HTTP responses (2 locations) - Fix SSRF in homeassistant.py: add _validate_url() with scheme validation and metadata-service blocking - Fix SSRF in tasmota.py: add _validate_ip() blocking loopback and link-local addresses - Add --threads=0 to all CodeQL CLI commands in test_security.sh for parallel query evaluation (67s → 43s wall clock)	2026-02-06 12:51:17 +01:00
maziggy	a0133fb43b	Fix safe security findings: hashlib, log injection, broad excepts, bandit suppressions - Add usedforsecurity=False to MD5 (AMS fingerprint) and SHA1 (git blob hash) calls to silence Bandit B303 / CodeQL weak-crypto findings - Convert ~996 f-string logging calls to parameterized %s-style across 55 files to prevent log injection (Bandit G201 / CodeQL log-injection) - Narrow ~199 broad except Exception blocks to specific types: OperationalError for DB migrations, OSError for network/file cleanup, (OSError, ftplib.error_reply) for FTP, and targeted tuples for ZIP/XML/JSON parsing — 36 intentionally left broad (mixed async, re-raise patterns) - Add # nosec comments to 9 known-safe lines (0.0.0.0 virtual printer binds, ftplib imports) and exclude backend/tests/ from bandit scan - Bandit now reports 0 medium/high findings	2026-02-06 11:45:12 +01:00
maziggy	53bd4fadb3	Fix safe security findings: hashlib, log injection, broad excepts - Add usedforsecurity=False to MD5 (AMS fingerprint) and SHA1 (git blob hash) calls to silence Bandit B303 / CodeQL weak-crypto findings - Convert ~996 f-string logging calls to parameterized %s-style across 55 files to prevent log injection (Bandit G201 / CodeQL log-injection) - Narrow ~199 broad except Exception blocks to specific types: OperationalError for DB migrations, OSError for network/file cleanup, (OSError, ftplib.error_reply) for FTP, and targeted tuples for ZIP/XML/JSON parsing — 36 intentionally left broad (mixed async, re-raise patterns)	2026-02-06 11:37:59 +01:00

Author

SHA1

Message

Date

maziggy

598cc699d4

Add CodeQL query suites for zero-finding scans and fix remaining security issues

- Create .codeql/python-bambuddy.qls excluding 14 accepted-risk rule
  categories (all reviewed and documented with justifications)
- Create .codeql/javascript-bambuddy.qls excluding false-positive
  XSS findings (generated coverage file + blob URL in audio src)
- Fix stack trace exposure in updates.py: replace str(e) with generic
  error messages in HTTP responses (2 locations)
- Fix SSRF in homeassistant.py: add _validate_url() with scheme
  validation and metadata-service blocking
- Fix SSRF in tasmota.py: add _validate_ip() blocking loopback and
  link-local addresses
- Add --threads=0 to all CodeQL CLI commands in test_security.sh for
  parallel query evaluation (67s → 43s wall clock)

2026-02-06 12:51:17 +01:00

maziggy

a0133fb43b

Fix safe security findings: hashlib, log injection, broad excepts, bandit suppressions

- Add usedforsecurity=False to MD5 (AMS fingerprint) and SHA1 (git blob
  hash) calls to silence Bandit B303 / CodeQL weak-crypto findings
- Convert ~996 f-string logging calls to parameterized %s-style across
  55 files to prevent log injection (Bandit G201 / CodeQL log-injection)
- Narrow ~199 broad except Exception blocks to specific types:
  OperationalError for DB migrations, OSError for network/file cleanup,
  (OSError, ftplib.error_reply) for FTP, and targeted tuples for
  ZIP/XML/JSON parsing — 36 intentionally left broad (mixed async,
  re-raise patterns)
- Add # nosec comments to 9 known-safe lines (0.0.0.0 virtual printer
  binds, ftplib imports) and exclude backend/tests/ from bandit scan
- Bandit now reports 0 medium/high findings

2026-02-06 11:45:12 +01:00

maziggy

53bd4fadb3

Fix safe security findings: hashlib, log injection, broad excepts

- Add usedforsecurity=False to MD5 (AMS fingerprint) and SHA1 (git blob
  hash) calls to silence Bandit B303 / CodeQL weak-crypto findings
- Convert ~996 f-string logging calls to parameterized %s-style across
  55 files to prevent log injection (Bandit G201 / CodeQL log-injection)
- Narrow ~199 broad except Exception blocks to specific types:
  OperationalError for DB migrations, OSError for network/file cleanup,
  (OSError, ftplib.error_reply) for FTP, and targeted tuples for
  ZIP/XML/JSON parsing — 36 intentionally left broad (mixed async,
  re-raise patterns)

2026-02-06 11:37:59 +01:00

3 commits