Update develop branch - #23
Merged
Merged
Conversation
[FIX] Fixed order of authentication methods for timeline filter endpoint.
…interactive editors
… with user case-access gating
…se-access, customers, audit, MFA reset and API-key rotation
…solutions, analysis statuses, event categories and task statuses
…e PUT and POST backup, deprecating the legacy /manage/settings routes
… credentials from user schemas and marking sensitive fields load-only Backport of f1d41f4 from v2.4.29. UserSchema, UserFullSchema, and BasicUserSchema were leaking mfa_secrets and webauthn_credentials in serialized responses, letting an attacker bypass MFA or impersonate the user (CWE-201, SBA-ADV-20260126-04). user_password is now load-only on UserSchema, and DSFileSchema.file_local_name (server-side path) is declared load-only at the schema layer instead of being del'd in the route handler. The matching v2 schema (UserSchemaForAPIV2) already had these guards; this commit aligns the legacy schemas still in use.
…er, profile and taxonomy admin endpoints Backport of f84b7b9 from v2.4.29, extended to cover the v2 surface that didn't exist when the original fix shipped. The legacy /manage/users, /manage/asset-type, /manage/ioc-types, /profile/update endpoints accepted the raw request body and handed it straight to the marshmallow schema. The schemas' `unknown = EXCLUDE` drops unknown keys but every declared field on the schema is still accepted — so a caller could overwrite the primary key (mass-assignment of asset_id / type_id), self-promote to admin via user_isadmin on the profile endpoint, or set arbitrary attributes the GUI never exposes (SBA-ADV-20260128-01 / CWE-915). Each writable endpoint now goes through an explicit per-resource allowlist before the schema is loaded. The taxonomy CRUD on rest/v2/manage_routes/case_objects.py declares the allowlist on the shared TaxonomyConfig so the asset-type, ioc-type, classification, state and evidence-type sub-blueprints all inherit the protection without duplication. GHSA-g588 already made user_password load_only on UserSchema, so the legacy /manage/users/add no longer needs the `del udata['user_password']` guard either; remove it.
… allowlist Backport of 371c640 from v2.4.29, adapted to develop's _is_safe_url in business/auth.py. The previous check only verified that urlparse(target).scheme and urlparse(target).netloc were empty. urlparse treats `attacker.com?cid=1` as a path with an empty netloc, so the guard accepted attacker-controlled hosts; browsers resolving the resulting `Location: attacker.com` header route the user to the attacker's origin (CWE-601 / SBA-ADV-20260126-02). _is_safe_url now requires the target to be a non-empty string starting with a single `/` (rejecting both protocol-relative `//evil.com` and backslash variants like `/\\evil.com`) and free of control characters, with the urlparse check kept as defense in depth.
…TASTORE_PATH and allowlisting writable upload fields Backport of 57c1b80 from v2.4.29, extended to the v2 datastore route that didn't exist when the original fix shipped. datastore_delete_file and datastore_get_local_file_path now resolve the recorded file_local_name and refuse to operate on a path outside the configured DATASTORE_PATH. Even though the dsf row is legitimately fetched through (file_id, case_id), a stored path pointing elsewhere (stale row from a different mount, attacker-seeded value) would let an unlink or send_file escape the datastore — CWE-22. The legacy /datastore/file/add + /datastore/file/update routes and the v2 add_file + update_file methods now project the multipart form down to an allowlist before the schema is loaded, blocking mass-assignment of file_id, file_local_name, file_case_id, file_sha256, file_size, added_by_user_id, file_date_added and friends.
…requiring POST on logout Backport of b202f54 from v2.4.29, extended to cover the v2 alerts update endpoint that didn't exist when the original fix shipped. Alert update (legacy single + batch, and v2 PUT /alerts/<id>) now strips alert_id, alert_customer_id and alert_creation_time from the payload before the schema is loaded. Allowing those via the API let a user with write access to one customer re-attribute an alert to a customer they cannot see — silently hiding it from the rightful owner and planting it under another tenant's view (CWE-863 / SBA-ADV-20260128-05). The logout endpoint moves from GET to POST. A plain <img src="/logout"> on a third-party page would otherwise log the user out without consent (RFC 7231 §4.2.1: GET must be safe; CWE-650 / SBA-ADV-20260128-03). The sidenav link wraps a hidden form so existing accessibility / styling keeps working.
…ces a missing user users_get_active() raises ObjectNotFoundError when a JWT or session points at a deleted/inactive user, which propagated to the Flask exception handler and logged a 500 on routine calls like POST /auth/logout. Wrap the lookup so the JWT path reports "invalid" (401) and the legacy/session paths fall through as unauthenticated. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
…EXISTS(CaseTags JOIN Tags)
…on; admin edits no longer reset on worker boot
…oup_permissions when the key is absent
…ete stay allowed after publish
…-log endpoint; server-side search on /chat
…/unarchive endpoints, open-first sort
…rences/<key> endpoints
…k + single-use session flag
…IRIS_HOSTNAME single-source-of-truth, certbot deploy-hook
…lteKit UI service
…service + hook listeners + /api/v2/notifications endpoints + /notifications SocketIO namespace + /users/mentionable directory for analyst mention search
…nt/both target, deploy-to-existing) + incident-rules with nested AND/OR conditions, back-fill, JSONB path support (alert_context.foo.bar)
…igation-flows (getters/list/create/update/deploy/backfill), server-owned rule_created_by/flow_created_by attribution, public proxies for cross-module access-control helpers
…ident-statuses endpoint, escalate crash fix
…and detect stopped iriswebapp_db container
… add war_room_id scoping and /_diag notifications endpoint
…r and multi-GB datastore uploads aren't truncated
…_room relationship that broke gunicorn boot (WarRoom unresolvable at mapper-config time)
…expose source-incident on cases
…om case, business helpers
…ross models, migrations, business, REST, schemas, hooks, celery tasks, tests
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.