Lukas
0481810226
Validate the ?next= query parameter to prevent open redirects to external URLs. The parameter is validated to ensure it is a relative path (starts with / but not //) before using it for navigation. Invalid paths fall back to '/'. This prevents attackers from crafting login links like /login?next=https://evil.com that would transparently redirect authenticated users to malicious sites. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
20 lines
1.6 KiB
Markdown
20 lines
1.6 KiB
Markdown
# BanGUI — Architecture Issues & Refactoring Plan
|
|
|
|
This document catalogues architecture violations, code smells, and structural issues found during a full project review. Issues are grouped by category and prioritised.
|
|
|
|
---
|
|
|
|
## Security Fixes
|
|
|
|
- Fixed open redirect vulnerability in `frontend/src/pages/LoginPage.tsx` by validating the `?next=` parameter to ensure it is a relative path (starts with `/` but not `//`). The validation regex `/^\/(?!\/)/.test(next)` prevents protocol-relative URLs and external redirects. Invalid paths fall back to `"/"`.
|
|
|
|
---
|
|
|
|
## Completed Refactors
|
|
|
|
- Moved `Fail2BanConnectionError` and `Fail2BanProtocolError` from `backend/app/utils/fail2ban_client.py` into `backend/app/exceptions.py`. Updated all router, service, and test call sites to import these domain exceptions from `app.exceptions` and retained backward compatibility through re-exporting in `app.utils.fail2ban_client`.
|
|
- Moved config file exceptions (`ConfigDirError`, `ConfigFileNotFoundError`, `ConfigFileExistsError`, `ConfigFileWriteError`, `ConfigFileNameError`) from `backend/app/services/raw_config_io_service.py` into `backend/app/exceptions.py`. Updated router and tests to import the shared domain exceptions from `app.exceptions`.
|
|
- Added global domain exception handlers to `backend/app/main.py` so domain exceptions like `JailNotFoundError`, `ConfigValidationError`, and `ConfigWriteError` map consistently to 404, 400, and 500 responses.
|
|
- Fixed stale activation tracking in `backend/app/routers/jail_config.py` by recording `last_activation` only after a successful jail activation and preventing a failed activation attempt from leaving a stale runtime state record.
|
|
|