fix: validate header names/values and prevent CRLF injection (#1817) - #2442
Closed
SaumyaT-21 wants to merge 948 commits into
Closed
fix: validate header names/values and prevent CRLF injection (#1817)#2442SaumyaT-21 wants to merge 948 commits into
SaumyaT-21 wants to merge 948 commits into
Conversation
- New reportTemplates.ts service with ReportTemplate type, three built-in templates (executive, technical, compliance), and render/preview/export. - ReportTemplatePicker.tsx slide-over component with type filtering, inline preview, and .md export. - Integrate Templates button into Reports.tsx report cards. - 21 unit tests covering template lifecycle, edge cases, and output.
…tksh1#1547) * Resolves issue-utksh1#1413 * test: remove trailing whitespace
…1546) Co-authored-by: tmdeveloper007 <[email protected]>
Co-authored-by: tmdeveloper007 <[email protected]>
Co-authored-by: tmdeveloper007 <[email protected]>
…h1#1542) Co-authored-by: tmdeveloper007 <[email protected]>
Co-authored-by: tmdeveloper007 <[email protected]>
Co-authored-by: tmdeveloper007 <[email protected]>
Co-authored-by: tmdeveloper007 <[email protected]>
Co-authored-by: tmdeveloper007 <[email protected]>
Co-authored-by: tmdeveloper007 <[email protected]>
…ksh1#1527) * Resolves issue-utksh1#1427 * Removes white spaces.
…odule (utksh1#1524) The extract_target helper in executor.py is a pure function but lives in a heavy import chain (FastAPI, cache, config). Per the maintainer's approved extraction pattern (used for routes_json_helpers), this extracts extract_target into a small import-safe executor_target_helpers module and re-exports it from executor.py so existing call sites keep working. Closes utksh1#1389. Co-authored-by: tmdeveloper007 <[email protected]>
The debug default was changed from True to False in the security fix. Update the test to match the new secure default.
The saved_views_router now has require_api_key dependency. Override it in tests to bypass authentication for unit testing.
Add shared time_utils helpers and use timezone-aware UTC with an explicit offset for generated_at and discovered_at across reports, findings API responses, and report generation. Closes utksh1#1882
Default to_utc_iso to timespec=auto so finding intelligence tests can compare against datetime.now(UTC). Update TLS verification mocks for crawler client.stream() and stub crawl_target in API scanner tests.
…idable _init_default_policies() built the entire network denylist from the single Pydantic field settings.network_denylist. Pydantic replaces (rather than merges) a list field's default when SECUSCAN_NETWORK_DENYLIST is set via env var, so any operator adding even one custom denylist entry silently dropped the built-in protection for cloud metadata (169.254.169.254), loopback, RFC1918/CGNAT ranges, and IPv6 link-local/ULA space -- reopening SSRF to the metadata endpoint despite the code comment claiming the denylist was 'always enforced'. Fix: move those ranges into a new MANDATORY_DENYLIST module constant that is not read from settings and is applied unconditionally in _init_default_policies before any operator-configured entries. The operator-facing network_denylist setting is now purely additive. Also updates the existing default-denylist test and adds a regression test reproducing the exact scenario from utksh1#1748.
…ne-standardize-9bb6 fix(backend): standardize timezone handling to UTC ISO-8601
…t-metadata-ssrf Fix utksh1#1748: make cloud-metadata/private-range denylist non-overridable
Fix: add auth and owner isolation to saved views API (closes utksh1#1743)
Cover the scapy_recon plugin parser.py with targeted behavioural tests: - Metadata contract: file existence, valid JSON, required fields, engine binary, target/type field declarations - ARP output: host count, IP+MAC extraction, finding keys, category, severity, description content, metadata consistency, remediation - ICMP output: host count, IP extraction, Unknown-MAC default - Single-host edge case: IP+MAC in result and description - Malformed/empty input: empty string, whitespace-only, no UP: lines, mixed noise lines, malformed UP: lines, missing MAC separator No changes to backend source; test file only.
* fix: stop dashboard polling after health failure and add manual retry * fix: skip pre-existing upstream auth tests that cannot pass with mocked auth * fix: update postcss to resolve GHSA-r28c-9q8g-f849 high severity vulnerability * fix: document localhost-only Docker binding, add opt-in network override
Collaborator
Author
|
Hey @utksh1 ! Added the fix for CRLF injection and HTTP token validation. All green on CI checks. Please go ahead and review the changes! |
utksh1
requested changes
Aug 4, 2026
utksh1
left a comment
utksh1
left a comment
Owner
There was a problem hiding this comment.
Request changes: _HEADER_NAME_re.match() is not anchored, so a value such as X-Test@invalid can pass by matching only the valid prefix. Use a full match/anchors and add tests for trailing invalid characters. Also remove the unrelated frontend/package-lock.json update and add coverage for invalid field values through the actual header-building path.
utksh1
added
area:backend
Collaborator
Author
|
Hey @utksh1 ! All requested backend header validation logic and unit test coverage have been updated and are passing locally. As requested, I've left package-lock.json untouched to keep this PR focused purely on backend changes but frontend checks are currently failing. Please review the latest commits and let me know how to proceed. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Validates HTTP header names and values in
crawler.pyto ensure they conform to HTTP specs.Specifically:
\r(Carriage Return) and\n(Line Feed) characters to prevent header injection (CRLF) vulnerabilities.ValueErrorwith clear messaging when an invalid header format or illegal character is detected.Related Issues
Closes #1817
Type of Change
How Has This Been Tested?
Tested manually via a local test block in
crawler.pyusing Python in the project's virtual environment:\ror\ncharacters in either the header name or the header value correctly raises aValueError.Checklist