Repository navigation
Updating App security and stability to bring it up to standards - #2
Open
JordanKeo45 wants to merge 30 commits into
Open
JordanKeo45 wants to merge 30 commits into
JordanKeo45 wants to merge 30 commits into
Conversation
…l field - Link Details: new Processing panel showing per-file review copy, HLS and watermark status with progress, errors and Retry. - Delete link/project dialogs: say when all files are used by other links and disable cleanup; show "deletable of total" sizes and a collapsible file list; "Untitled link" label. - Settings: "Renewed your license?" key field. - Remove dead outputs_exist prompt, unused watermarkRelPath option and the ingest.register log filter.
Add CIDR guidance, policy previews, and apply/confirm UI. Include regression tests and combined test runner.
Show queued/running scan feedback during desktop upload finalization and retain server-reported passed or skipped results. Clear transfer speed and ETA while waiting, preserve legacy-server compatibility, and add progress regression tests.
…iene QA - Store admin JWTs and opt-in remembered passwords using Electron safeStorage - Migrate legacy credentials out of localStorage and sessionStorage - Reject insecure Linux basic_text storage and use memory-only sessions - Guard credential IPC and clear saved credentials on logout or removal - Prevent late authentication responses from restoring logged-out sessions - Add native restart checks for KWallet, GNOME Keyring, DPAPI and Keychain - Document automated coverage, JSON reports and remaining deployment checks
Disable and refuse Electron webviews, remove the unused webview preload, and send sudo passwords over stdin during remote setup. Use a private temporary setup script that is removed on exit.
…leanup - Truncate long link titles and show the full value on hover - Show License Expired and Pro Legacy labels instead of stale trial status - Consolidate duplicate license-expiry notifications - Display the correct legacy-license panel in Settings - Close and reset Quick Share on logout or session expiry
- Redirect unauthenticated server selections to the prefilled reconnect form - Prevent protected views from rendering without a connected session - Show logged-out and reconnect-required status in connection lists - Preserve immediate switching between connected servers - Add session-guard regression tests
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
- security.yml: Yarn audit across all workspaces (fails on high/critical) and Gitleaks secret scan on PRs and pushes; manual run scans full history - semgrep.yml: report-only Semgrep CE (JS/TS/Node/Express), SARIF upload - dependabot.yml: weekly npm + GitHub Actions updates, minor/patch grouped - .gitignore: allow the new workflow files to be committed
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
- security.yml: --mode=skip-builds -> --mode=skip-build (valid Yarn 4 value) - secureTokens.test.js: pass authTagLength to createDecipheriv (clears Semgrep gcm-no-tag-length)
- Refresh vulnerable transitive packages within existing ranges - electron-builder 26.0.12 -> 26.18.0; vitest 3 -> 4 - Scoped resolutions for houston-common tooling: vitest 4, zod 4 + zod-validation-error 4, patched lodash/minimatch; dedupe electron pulled in by @types/electron - CI audit now reads .github/audit-exceptions.json: ignores only the listed Electron 38 / extract-zip advisory IDs until 2027-01-31 and fails once expired (Electron upgrade tracked separately)
- Enable renderer sandbox; preload only requires electron - Allowlist IPC channels in the preload bridge and stop passing the raw IpcRendererEvent (its sender exposed unrestricted ipcRenderer) - Drop 'unsafe-inline' from script-src; add object-src/base-uri 'none' - Block app-window navigation away from the bundled renderer - Reject chains using the compromised eMudhra intermediate keys (GHSA-jr5w-w6x2-84p9) in the default session, the electron-updater session, and Node TLS, mirroring Electron 42.11.16's blocklist
- scripts/test-hardening.cjs: launches the real built app in a temp profile and checks sandbox/isolation, preload API, IPC allowlist, sender stripping, navigation and window.open guards, route rendering, console for blocked-IPC/CSP errors, and the blocked-key certificate checks (default session, updater session, Node TLS) with a local PKI - preload.test.js: fail if any literal renderer IPC channel is not allowlisted
Replaces Array#includes with an explicit equality helper; CodeQL read it as URL substring sanitization (false positive).
DELETE /api/links/:linkId/comments/:commentId (auth + license) soft-deletes a comment and its replies, logs activity/audit, and notifies open share pages.
Check every selected file before starting transfers or transcoding. Report all rejected files without partially uploading the batch. Add spreadsheet and Word MIME mappings. Requires the server batch-validation endpoint.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Brings app closer to TPN Complaince requirements and follows standard best practices for security