rodrigo/genieacs
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,167 Commits 9 Branches 32 Tags
38e9dfd0e6dcac51087d11040784fda76ad2460a
Commit Graph
643 Commits
Author SHA1 Message Date
Zaid Humaimidi 087b95388f Fix RCE vulnerability in /api/ping endpoint 
This addresses a follow-up to CVE-2021-46704 where the host validation
could be bypassed via domainToASCII stripping path components.

Changes:
- Normalize host with domainToASCII before validation
- Add round-trip check with domainToUnicode to catch path injection
- Switch from exec to execFile to prevent shell injection
- Add -- separator to ping arguments

Credit: JuHwiSang for reporting this vulnerability
 2026-03-25 15:00:00 -07:00
Zaid Humaimidi 729beba0ed Update dependencies 2026-03-12 12:38:03 -07:00
Zaid Humaimidi 1b14387aa2 Fix covers() for false and contradictions 2026-03-12 10:21:03 -07:00
Zaid Humaimidi 49cdd39617 Fix (de)serialization bug in VersionedMap 2025-02-12 19:05:08 -08:00
Zaid Humaimidi 4be39ed742 Replace deprecated koa middleware 2024-10-04 11:28:04 -07:00
Zaid Humaimidi 8ddb692370 Prevent UI crash when malformed URL is sent 2024-10-04 11:05:07 -07:00
Zaid Humaimidi 307b9f57b0 Fix bug in Mongo query construction 2024-04-18 11:51:29 -07:00
Zaid Humaimidi 60e6d8b175 Fix regression in CSV and JSON streaming 2024-03-27 14:08:35 -07:00
Zaid Humaimidi ab80a62c5c Fix bug preventing XMPP client from connecting 2024-03-27 13:57:09 -07:00
Zaid Humaimidi cdbfb172c7 Remove certificate validation check 
Breaks compatibility with Node 12 and it's not really necessary anyway.
 2024-03-20 17:11:14 -07:00
Zaid Humaimidi 3701c73b00 Update dependencies 2024-03-18 19:17:47 -07:00
Zaid Humaimidi 450fc6fe53 Fix lock expired errors 2024-03-11 11:04:49 -07:00
Divya Jagadish 6962cedba9 Fix exception caused by invalid con req URL 2024-03-09 13:14:38 -08:00
Zaid Humaimidi 227a005400 Fix exception when URL has two trailing slashes 2024-03-07 13:27:06 -08:00
Divya Jagadish 24cd3f5670 Support cert and key as string env variable 2024-03-03 13:48:00 -08:00
Divya Jagadish 052706877a Fix bug in Change Password 2024-03-02 11:31:47 -08:00
Zaid Humaimidi 867e7e768d Fix crash with certain validator expressions 2024-03-01 09:47:12 -08:00
Zaid Humaimidi effd574f4e XMPP connection request 2024-02-27 11:41:03 -08:00
Zaid Humaimidi f3068c5355 Improve pagination/sorting 2024-02-24 04:26:40 -08:00
Zaid Humaimidi 0dee9a5f00 Remove license headers and update imports 2023-12-18 19:13:59 -08:00
Zaid Humaimidi 0c9c027a77 Update linting 2023-12-16 19:08:13 -08:00
Zaid Humaimidi 4f2dfb4f48 Drop Rollup in favor of esbuild 2023-12-12 22:27:58 -08:00
Zaid Humaimidi 342210faf1 Utilize locks to prevent certain edge case issues 2023-12-06 11:10:23 -08:00
Zaid Humaimidi f4596db9f7 Remove caching of tasks, faults and operations 
No longer seems to provide significant performance benefit to justify the
drawback of the added code complexity and the additional DB write query.
 2023-11-23 10:34:47 -08:00
Zaid Humaimidi d122b224b0 Resolve issues from DB lock collection migration 2023-11-16 15:58:26 -08:00
Zaid Humaimidi 4cb143cc0a Encode event codes containing illegal chars 2023-11-13 15:18:24 -08:00
Zaid Humaimidi 8d11e1cdd9 Support conditional requests in genieacs-fs 2023-11-13 13:25:29 -08:00
Zaid Humaimidi f7e75caf2c Support Range header in genieacs-fs 2023-11-10 15:15:24 -08:00
Divya Jagadish 02665faa9f Move locks to their own DB collection 2023-10-08 12:14:06 -07:00
Zaid Humaimidi c3954c277f Refactor db and local-cache code 
Separated cwmp and ui code into distinct files to enhance clarity and
maintainability with varied internal data representations.
 2023-09-29 14:55:44 -07:00
Clément Hampaï 493f1d2f37 Support HEAD query on fs endpoint 
Some CPEs query the FS endpoint with a `HEAD` request first before downloading
the image using a `GET`.
 2023-08-30 18:14:59 -07:00
Zaid Humaimidi 39bb937f9d Fix oversight in commit 58488eb 2023-08-29 12:20:53 -07:00
Zaid Humaimidi 35b193f058 Fix bug in handling of 9005 faults 2023-08-28 18:21:19 -07:00
Zaid Humaimidi ea956fbc9c 404 when updating tags of non-existing devices 2023-08-28 18:17:22 -07:00
Zaid Humaimidi a0ad6ec3f1 Fix crash with certain validator expressions 2023-08-28 18:16:40 -07:00
Zaid Humaimidi 7b8a49a7ba Refactor request listeners to use async functions 2023-08-09 19:51:40 -07:00
Zaid Humaimidi 58488ebc3d Refactor DB code to use promises 2023-08-09 19:51:38 -07:00
Zaid Humaimidi 3169e829e7 Refactor expression to Mongo query translation 
The previous approach was simplistic and could result in inefficient queries
in certain edge cases, notably causing MongoDB to not utilize existing indexes
when querying by last inform timestamps given upper and lower bounds. The new
implementation leverages our existing expression minimizer code and can
therefore generate more efficient queries or at least queries that can take
advantage of existing indexes.
 2023-08-09 19:48:49 -07:00
Zaid Humaimidi 947f96299d Prevent premature close error in small files 2023-04-19 12:01:53 -07:00
Zaid Abdulla d1c01e0848 Fix FS drops connection if download is too slow 
Only happens in HTTPS because seemingly somewhere in the stack up to
50mb of data is being buffered potentially triggering a timeout at a
higher level if not drained fast enough.

This commit also includes other streams related improvements.
 2022-11-01 09:13:36 -07:00
Zaid Abdulla 25ea0c8b64 Update dependencies 2022-08-22 09:44:25 -07:00
Zaid Abdulla 2789961596 Skip invalid timestamps in declare() 2022-08-12 16:30:00 -07:00
Zaid Abdulla d91be02599 Fix exception matching IPv6 against IPv4 CIDR 2022-08-12 11:32:15 -07:00
Zaid Abdulla 5806fe2df6 Better locking in local cache 
Fixes occassional lock expired errors after updating presets, etc.
 2022-08-12 01:11:04 -07:00
Zaid Abdulla eb5caa6b5a Skip root GPN workaround 2022-08-01 11:32:05 -07:00
Zaid Abdulla ffbcf2bbc0 Fix Mongo query bug when using <> operator 2022-07-15 11:36:15 -07:00
Zaid Abdulla b0d50b07e7 Fix synthesized expressions being non-minimal 
Let's try this again. The implementation of canRaise callback was
overly complicated and was causing the minimizer to ocassionally
get stuck in a local optima.
 2022-06-14 11:23:33 -07:00
Zaid Abdulla c06538f9cc Fix browser quirks mode warning 2022-04-08 13:14:27 -07:00
Divya Jagadish dabf1b2f43 Improve sorting behavior by adding delay 2022-04-08 13:08:41 -07:00
Divya Jagadish 7941d929d2 Fix ping bug on certain platforms 2022-04-08 13:01:05 -07:00