public_git/bambuddy
1
0
Fork 0
mirror of https://github.com/maziggy/bambuddy.git synced 2026-09-30 03:01:21 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add .trivyignore to suppress Dockerfile USER directive finding (DS-0002)

Browse Source 
Bambuddy runs as a single-host Docker container where root is needed
for device access and FFmpeg. Trivy picks up the file automatically.
This commit is contained in:
maziggy
2026-02-06 13:05:35 +01:00
parent 7b90c743c2
commit 01cb23ee85
2 changed files with 25 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.trivyignore
+3
View File
@@ -0,0 +1,3 @@
# Dockerfile USER directive (DS-0002): Bambuddy runs as a single-host
# Docker container where root is needed for device access and FFmpeg.
DS-0002
CHANGELOG.md
+22
View File
@@ -21,6 +21,28 @@ All notable changes to Bambuddy will be documented in this file.
- Added pip-audit and npm-audit for dependency vulnerability scanning
- Automatic GitHub issue creation for detected vulnerabilities
- Security scan results visible in GitHub Security tab
- **CodeQL Zero-Finding Baseline**:
- Reduced CodeQL findings from 591 to 0 across Python, JavaScript, and GitHub Actions
- Created custom query suites (`.codeql/python-bambuddy.qls`, `.codeql/javascript-bambuddy.qls`) with documented accepted-risk exclusions
- All exclusions reviewed and justified (log injection parameterized, cyclic imports from SQLAlchemy ORM, intentional 0.0.0.0 binds, etc.)
- **Log Injection Prevention**:
- Converted ~700 f-string log calls to parameterized `%s` style across all backend files
- Prevents log injection via newlines or fake log entries in user-controlled data
- **Exception Handling Hardened**:
- Narrowed ~265 bare `except Exception` blocks to specific types (`OSError`, `KeyError`, `ValueError`, `zipfile.BadZipFile`, `sqlalchemy.exc.OperationalError`, etc.)
- **Stack Trace Exposure Fixed**:
- Replaced `str(e)` with generic error messages in HTTP responses (`updates.py`)
- Detailed errors still logged server-side for debugging
- **SSRF Mitigations Added**:
- Home Assistant integration: URL scheme/hostname validation, metadata-service blocking (`homeassistant.py`)
- Tasmota integration: IP validation blocking loopback and link-local addresses (`tasmota.py`)
- **Hashlib Security Annotations**:
- Added `usedforsecurity=False` to non-security hash calls (MD5 for AMS fingerprinting, SHA1 for git blob format)
- **Unused Code Removal**:
- Removed ~30 redundant function-level imports, unused variables, dead code, and trivial conditions flagged by CodeQL
- **Local Security Scanner Improvements**:
- `test_security.sh` uses `--threads=0` for all CodeQL commands (auto-detects CPU cores)
- Added `.trivyignore` to suppress accepted Dockerfile USER directive finding
### Enhanced
- **Per-Filament Spoolman Usage Tracking** (PR #277):