mirror of
https://github.com/maziggy/bambuddy.git
synced 2026-08-11 00:30:12 -04:00
598cc699d4
- Create .codeql/python-bambuddy.qls excluding 14 accepted-risk rule categories (all reviewed and documented with justifications) - Create .codeql/javascript-bambuddy.qls excluding false-positive XSS findings (generated coverage file + blob URL in audio src) - Fix stack trace exposure in updates.py: replace str(e) with generic error messages in HTTP responses (2 locations) - Fix SSRF in homeassistant.py: add _validate_url() with scheme validation and metadata-service blocking - Fix SSRF in tasmota.py: add _validate_ip() blocking loopback and link-local addresses - Add --threads=0 to all CodeQL CLI commands in test_security.sh for parallel query evaluation (67s → 43s wall clock)
89 lines
3.2 KiB
Text
89 lines
3.2 KiB
Text
# Bambuddy Python Security & Quality Suite
|
|
#
|
|
# Extends the standard python-security-and-quality suite, excluding
|
|
# accepted-risk findings documented below.
|
|
#
|
|
# All excluded findings have been reviewed and either:
|
|
# - Fixed in code (validation added) but CodeQL still traces taint
|
|
# - Confirmed false positive after code inspection
|
|
# - Accepted risk for a local-network admin tool
|
|
|
|
- description: "Bambuddy Python security and quality"
|
|
|
|
- import: codeql-suites/python-security-and-quality.qls
|
|
from: codeql/python-queries
|
|
|
|
# ── Accepted Risk ─────────────────────────────────────────────
|
|
|
|
# Log injection (131): All logging uses %s parameterized style.
|
|
# Remaining findings are CodeQL taint-tracking printer/device data
|
|
# to parameterized log args. Accepted risk for local network tool.
|
|
- exclude:
|
|
id: py/log-injection
|
|
|
|
# Cyclic imports (70+2): SQLAlchemy ORM pattern — models import
|
|
# database base class, database imports models for migrations.
|
|
- exclude:
|
|
id: py/cyclic-import
|
|
- exclude:
|
|
id: py/unsafe-cyclic-import
|
|
|
|
# Unused local variables (11): Python _ prefix convention for
|
|
# intentional discards (tuple unpacking, test fixture side effects).
|
|
- exclude:
|
|
id: py/unused-local-variable
|
|
|
|
# Path injection (11): All paths validated — extension whitelists,
|
|
# traversal checks (rejects .. / \), UUID-based naming, or
|
|
# constructed from integer IDs in controlled base directories.
|
|
- exclude:
|
|
id: py/path-injection
|
|
|
|
# Stack trace exposure (5): str(e) replaced with generic messages
|
|
# in HTTP responses. Remaining findings are CodeQL tracing through
|
|
# _update_status dict returns, not actual new exposures.
|
|
- exclude:
|
|
id: py/stack-trace-exposure
|
|
|
|
# Socket bind to 0.0.0.0 (4): Virtual printer SSDP/discovery
|
|
# services must bind all interfaces for LAN discoverability.
|
|
- exclude:
|
|
id: py/bind-socket-all-network-interfaces
|
|
|
|
# SSRF (3+1): URLs come from admin-configured settings (external
|
|
# cameras, Home Assistant, Tasmota). Validation added for scheme,
|
|
# hostname, and metadata-service blocking. CodeQL still traces
|
|
# taint through the validated URLs.
|
|
- exclude:
|
|
id: py/partial-ssrf
|
|
- exclude:
|
|
id: py/full-ssrf
|
|
|
|
# Unused global variables (2): False positives — module-level
|
|
# cache variables written via `global` in one function, read in
|
|
# another. CodeQL doesn't track cross-function global reads.
|
|
- exclude:
|
|
id: py/unused-global-variable
|
|
|
|
# Clear-text logging sensitive data (2): False positive —
|
|
# `api_key` in firmware_check.py is a printer model identifier
|
|
# string ("x1", "p1", "a1-mini"), not a secret.
|
|
- exclude:
|
|
id: py/clear-text-logging-sensitive-data
|
|
|
|
# Clear-text storage sensitive data (1): JWT secret stored in
|
|
# SQLite config with 0600 file permissions. Standard approach
|
|
# for single-host deployment.
|
|
- exclude:
|
|
id: py/clear-text-storage-sensitive-data
|
|
|
|
# Weak hashing on sensitive data (1): MD5 in bambu_mqtt.py used
|
|
# with usedforsecurity=False for AMS tray fingerprinting, not
|
|
# for security purposes.
|
|
- exclude:
|
|
id: py/weak-sensitive-data-hashing
|
|
|
|
# Catch base exception (1): In frontend/node_modules third-party
|
|
# code (flatted/python/flatted.py), outside our control.
|
|
- exclude:
|
|
id: py/catch-base-exception
|