From 01cb23ee85c9bfd2f7d82b1e322fbeb9d244e84e Mon Sep 17 00:00:00 2001 From: maziggy Date: Fri, 6 Feb 2026 13:05:35 +0100 Subject: [PATCH] Add .trivyignore to suppress Dockerfile USER directive finding (DS-0002) Bambuddy runs as a single-host Docker container where root is needed for device access and FFmpeg. Trivy picks up the file automatically. --- .trivyignore | 3 +++ CHANGELOG.md | 22 ++++++++++++++++++++++ 2 files changed, 25 insertions(+) create mode 100644 .trivyignore diff --git a/.trivyignore b/.trivyignore new file mode 100644 index 000000000..9e5efae87 --- /dev/null +++ b/.trivyignore @@ -0,0 +1,3 @@ +# Dockerfile USER directive (DS-0002): Bambuddy runs as a single-host +# Docker container where root is needed for device access and FFmpeg. +DS-0002 diff --git a/CHANGELOG.md b/CHANGELOG.md index 1b50d5239..f5aa03b59 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -21,6 +21,28 @@ All notable changes to Bambuddy will be documented in this file. - Added pip-audit and npm-audit for dependency vulnerability scanning - Automatic GitHub issue creation for detected vulnerabilities - Security scan results visible in GitHub Security tab +- **CodeQL Zero-Finding Baseline**: + - Reduced CodeQL findings from 591 to 0 across Python, JavaScript, and GitHub Actions + - Created custom query suites (`.codeql/python-bambuddy.qls`, `.codeql/javascript-bambuddy.qls`) with documented accepted-risk exclusions + - All exclusions reviewed and justified (log injection parameterized, cyclic imports from SQLAlchemy ORM, intentional 0.0.0.0 binds, etc.) +- **Log Injection Prevention**: + - Converted ~700 f-string log calls to parameterized `%s` style across all backend files + - Prevents log injection via newlines or fake log entries in user-controlled data +- **Exception Handling Hardened**: + - Narrowed ~265 bare `except Exception` blocks to specific types (`OSError`, `KeyError`, `ValueError`, `zipfile.BadZipFile`, `sqlalchemy.exc.OperationalError`, etc.) +- **Stack Trace Exposure Fixed**: + - Replaced `str(e)` with generic error messages in HTTP responses (`updates.py`) + - Detailed errors still logged server-side for debugging +- **SSRF Mitigations Added**: + - Home Assistant integration: URL scheme/hostname validation, metadata-service blocking (`homeassistant.py`) + - Tasmota integration: IP validation blocking loopback and link-local addresses (`tasmota.py`) +- **Hashlib Security Annotations**: + - Added `usedforsecurity=False` to non-security hash calls (MD5 for AMS fingerprinting, SHA1 for git blob format) +- **Unused Code Removal**: + - Removed ~30 redundant function-level imports, unused variables, dead code, and trivial conditions flagged by CodeQL +- **Local Security Scanner Improvements**: + - `test_security.sh` uses `--threads=0` for all CodeQL commands (auto-detects CPU cores) + - Added `.trivyignore` to suppress accepted Dockerfile USER directive finding ### Enhanced - **Per-Filament Spoolman Usage Tracking** (PR #277):