mirror of
https://github.com/maziggy/bambuddy.git
synced 2026-08-11 00:30:12 -04:00
598cc699d4
- Create .codeql/python-bambuddy.qls excluding 14 accepted-risk rule categories (all reviewed and documented with justifications) - Create .codeql/javascript-bambuddy.qls excluding false-positive XSS findings (generated coverage file + blob URL in audio src) - Fix stack trace exposure in updates.py: replace str(e) with generic error messages in HTTP responses (2 locations) - Fix SSRF in homeassistant.py: add _validate_url() with scheme validation and metadata-service blocking - Fix SSRF in tasmota.py: add _validate_ip() blocking loopback and link-local addresses - Add --threads=0 to all CodeQL CLI commands in test_security.sh for parallel query evaluation (67s → 43s wall clock)
16 lines
602 B
Text
16 lines
602 B
Text
# Bambuddy JavaScript Security & Quality Suite
|
|
#
|
|
# Extends the standard javascript-security-and-quality suite,
|
|
# excluding false positives documented below.
|
|
|
|
- description: "Bambuddy JavaScript security and quality"
|
|
|
|
- import: codeql-suites/javascript-security-and-quality.qls
|
|
from: codeql/javascript-queries
|
|
|
|
# XSS through DOM (2): False positives —
|
|
# 1. coverage/sorter.js: generated Istanbul coverage report, not our code
|
|
# 2. TimelapseEditorModal.tsx: URL.createObjectURL(file) creates a safe
|
|
# blob: URL used as <audio src>, not HTML content injection
|
|
- exclude:
|
|
id: js/xss-through-dom
|