fix: harden Mactrack release boundaries#336
Draft
somethingwithproof wants to merge 10 commits into
Draft
Conversation
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
…polations in view pages
The string filters in the view/report pages were already routed through db_qstr(); this closes the remaining raw interpolations of numeric request vars (site_id, device_id, status, vlan, authorized, host_id, graph_template_id, device_type_id) into WHERE clauses by casting them with (int) at the concatenation point. These are declared FILTER_VALIDATE_INT in each validate_store_request_vars() array, so this is defense-in-depth that removes reliance on upstream validation and matches the intval() approach already used in mactrack_get_devices(). 1.2.31-idiomatic, PHP 7.4-safe.
Files: mactrack_view_{arp,ips,dot1x,interfaces,sites,graphs,macs}.php
Co-Authored-By: Oz <oz-agent@warp.dev>
mactrack_macauth.php: api_mactrack_maca_save() interpolated the user-supplied MAC address into an UPDATE ... LIKE "...%" (first-order SQLi); now bound via db_execute_prepared() with a ? placeholder. api_mactrack_maca_remove() called db_execute_prepared() while concatenating the (stored) mac_address into the SQL with no bound params (second-order SQLi + misuse of the prepared helper); the three DELETEs now bind mac_address as a parameter. mactrack_devices.php: Copy SNMP Settings (drp_action==7) built its UPDATE SET clause by interpolating host-table values with bare quotes; values are now bound with placeholders (column name stays interpolated as a trusted static-array key). Mirrors the fix already applied on the Cacti#334 branch. mactrack_device_types.php, mactrack_sites.php, mactrack_snmp.php: (int)-cast the remaining raw numeric request vars (type_id, site_id, and id used in snmp_id= fragments for move_item_up/down and get_sequence) — defense-in-depth over the FILTER_VALIDATE_INT request validation. 1.2.31-idiomatic, PHP 7.4-safe. Co-Authored-By: Oz <oz-agent@warp.dev>
Contributor
Author
SQL-injection hardening complete — requesting final reviewTwo follow-up commits finish parameterizing the remaining raw SQL in this PR. All bound via
|
…lver poller_mactrack.php: the aggregated-ports INSERT ... SELECT interpolated $scan_date (server date()) into an AND t2.scan_date = "..." predicate; switched to db_execute_prepared() with a ? placeholder (the same value is already bound at the earlier temp-ports update). No behavior change; removes the last raw interpolation on the collection path. mactrack_resolver.php: the DNS-resolution INSERT already routes every string column (including the untrusted PTR/dns_hostname) through db_qstr(); (int)-cast the two remaining raw numeric columns (site_id, device_id) for defense-in-depth. Note: the primary SNMP-value sinks db_store_device_port_results() and db_update_device_status() (lib/mactrack_functions.php) were already fully parameterized. 1.2.31-idiomatic, PHP 7.4-safe. Co-Authored-By: Oz <oz-agent@warp.dev>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
mikepultz/netdns21.5, retaining the existingNet_DNS2_*resolver API.Root cause
The initial dependency migration selected NetDNS2 2.x, which is namespaced and incompatible with Mactrack's legacy resolver API. This branch pins the maintained 1.5 compatibility line, and the E2E suite verifies the plugin enables successfully.
Validation
html_escape()-encoded display valueFollow-up