frank/ruvnet--RuView
1
0
Fork 0
mirror of https://github.com/ruvnet/RuView synced 2026-08-03 19:21:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

security: repair scanning and close stale alert sources

Browse Source
This commit is contained in:
ruv
2026-08-02 15:22:13 -04:00
parent 42492e14a5
commit 5780c239e4
48 changed files with 427 additions and 325 deletions
Download Patch File Download Diff File Expand all files Collapse all files
firmware/esp32-csi-node/main/c6_softap_he.c
+1 -1
View File
@@ -123,7 +123,7 @@ esp_err_t c6_softap_he_start(uint8_t *out_channel)
if (ssid_len > 32) ssid_len = 32;
memcpy(ap_cfg.ap.ssid, ssid, ssid_len);
ap_cfg.ap.ssid_len = (uint8_t)ssid_len;
strncpy((char *)ap_cfg.ap.password, psk, sizeof(ap_cfg.ap.password) - 1);
strlcpy((char *)ap_cfg.ap.password, psk, sizeof(ap_cfg.ap.password));
ap_cfg.ap.channel = s_channel;
ap_cfg.ap.max_connection = 4;
ap_cfg.ap.authmode = strlen(psk) >= 8 ? WIFI_AUTH_WPA2_PSK : WIFI_AUTH_OPEN;
firmware/esp32-csi-node/main/main.c
+10 -5
View File
@@ -112,8 +112,10 @@ static void wifi_init_sta(void)
};
/* Copy runtime SSID/password from NVS config */
strncpy((char *)wifi_config.sta.ssid, g_nvs_config.wifi_ssid, sizeof(wifi_config.sta.ssid) - 1);
strncpy((char *)wifi_config.sta.password, g_nvs_config.wifi_password, sizeof(wifi_config.sta.password) - 1);
strlcpy((char *)wifi_config.sta.ssid, g_nvs_config.wifi_ssid,
sizeof(wifi_config.sta.ssid));
strlcpy((char *)wifi_config.sta.password, g_nvs_config.wifi_password,
sizeof(wifi_config.sta.password));
/* If password is empty, use open auth */
if (strlen((char *)wifi_config.sta.password) == 0) {
@@ -431,9 +433,12 @@ void app_main(void)
.ingest_sec = g_nvs_config.swarm_ingest_sec,
.enabled = 1,
};
strncpy(swarm_cfg.seed_url, g_nvs_config.seed_url, sizeof(swarm_cfg.seed_url) - 1);
strncpy(swarm_cfg.seed_token, g_nvs_config.seed_token, sizeof(swarm_cfg.seed_token) - 1);
strncpy(swarm_cfg.zone_name, g_nvs_config.zone_name, sizeof(swarm_cfg.zone_name) - 1);
strlcpy(swarm_cfg.seed_url, g_nvs_config.seed_url,
sizeof(swarm_cfg.seed_url));
strlcpy(swarm_cfg.seed_token, g_nvs_config.seed_token,
sizeof(swarm_cfg.seed_token));
strlcpy(swarm_cfg.zone_name, g_nvs_config.zone_name,
sizeof(swarm_cfg.zone_name));
swarm_ret = swarm_bridge_init(&swarm_cfg, csi_collector_get_node_id());
if (swarm_ret != ESP_OK) {
ESP_LOGW(TAG, "Swarm bridge init failed: %s", esp_err_to_name(swarm_ret));
firmware/esp32-csi-node/main/nvs_config.c
+8 -13
View File
@@ -24,18 +24,16 @@ void nvs_config_load(nvs_config_t *cfg)
}
/* Start with Kconfig compiled defaults */
strncpy(cfg->wifi_ssid, CONFIG_CSI_WIFI_SSID, NVS_CFG_SSID_MAX - 1);
cfg->wifi_ssid[NVS_CFG_SSID_MAX - 1] = '\0';
strlcpy(cfg->wifi_ssid, CONFIG_CSI_WIFI_SSID, sizeof(cfg->wifi_ssid));
#ifdef CONFIG_CSI_WIFI_PASSWORD
strncpy(cfg->wifi_password, CONFIG_CSI_WIFI_PASSWORD, NVS_CFG_PASS_MAX - 1);
cfg->wifi_password[NVS_CFG_PASS_MAX - 1] = '\0';
strlcpy(cfg->wifi_password, CONFIG_CSI_WIFI_PASSWORD,
sizeof(cfg->wifi_password));
#else
cfg->wifi_password[0] = '\0';
#endif
strncpy(cfg->target_ip, CONFIG_CSI_TARGET_IP, NVS_CFG_IP_MAX - 1);
cfg->target_ip[NVS_CFG_IP_MAX - 1] = '\0';
strlcpy(cfg->target_ip, CONFIG_CSI_TARGET_IP, sizeof(cfg->target_ip));
cfg->target_port = (uint16_t)CONFIG_CSI_TARGET_PORT;
cfg->node_id = (uint8_t)CONFIG_CSI_NODE_ID;
@@ -110,24 +108,21 @@ void nvs_config_load(nvs_config_t *cfg)
/* WiFi SSID */
len = sizeof(buf);
if (nvs_get_str(handle, "ssid", buf, &len) == ESP_OK && len > 1) {
strncpy(cfg->wifi_ssid, buf, NVS_CFG_SSID_MAX - 1);
cfg->wifi_ssid[NVS_CFG_SSID_MAX - 1] = '\0';
strlcpy(cfg->wifi_ssid, buf, sizeof(cfg->wifi_ssid));
ESP_LOGI(TAG, "NVS override: ssid=%s", cfg->wifi_ssid);
}
/* WiFi password */
len = sizeof(buf);
if (nvs_get_str(handle, "password", buf, &len) == ESP_OK) {
strncpy(cfg->wifi_password, buf, NVS_CFG_PASS_MAX - 1);
cfg->wifi_password[NVS_CFG_PASS_MAX - 1] = '\0';
strlcpy(cfg->wifi_password, buf, sizeof(cfg->wifi_password));
ESP_LOGI(TAG, "NVS override: password=***");
}
/* Target IP */
len = sizeof(buf);
if (nvs_get_str(handle, "target_ip", buf, &len) == ESP_OK && len > 1) {
strncpy(cfg->target_ip, buf, NVS_CFG_IP_MAX - 1);
cfg->target_ip[NVS_CFG_IP_MAX - 1] = '\0';
strlcpy(cfg->target_ip, buf, sizeof(cfg->target_ip));
ESP_LOGI(TAG, "NVS override: target_ip=%s", cfg->target_ip);
}
@@ -313,7 +308,7 @@ void nvs_config_load(nvs_config_t *cfg)
}
len = sizeof(cfg->zone_name);
if (nvs_get_str(handle, "zone_name", cfg->zone_name, &len) != ESP_OK) {
strncpy(cfg->zone_name, "default", sizeof(cfg->zone_name) - 1);
strlcpy(cfg->zone_name, "default", sizeof(cfg->zone_name));
}
if (nvs_get_u16(handle, "swarm_hb", &cfg->swarm_heartbeat_sec) != ESP_OK) {
cfg->swarm_heartbeat_sec = 30;
firmware/esp32-csi-node/main/wasm_runtime.c
+1 -2
View File
@@ -786,8 +786,7 @@ esp_err_t wasm_runtime_set_manifest(uint8_t module_id, const char *module_name,
}
if (module_name) {
strncpy(slot->module_name, module_name, 31);
slot->module_name[31] = '\0';
strlcpy(slot->module_name, module_name, sizeof(slot->module_name));
}
slot->capabilities = capabilities;
slot->manifest_budget_us = max_frame_us;
firmware/esp32-csi-node/main/wasm_upload.c
+3 -1
View File
@@ -183,7 +183,9 @@ static esp_err_t wasm_upload_handler(httpd_req_t *req)
#else
format = "raw";
err = wasm_runtime_load(buf, (uint32_t)total, &module_id);
free(buf);
/* CONFIG_WASM_SKIP_SIGNATURE makes this and the reject branch above
* mutually exclusive, so the raw payload is released exactly once. */
free(buf); /* nosemgrep: c.lang.security.double-free.double-free */
if (err != ESP_OK) {
char msg[80];
firmware/esp32-csi-node/provision.py
+3 -1
View File
@@ -264,7 +264,9 @@ def generate_nvs_binary(csv_content, size):
gen_script = os.path.join(idf_path, "components", "nvs_flash",
"nvs_partition_generator", "nvs_partition_gen.py")
if os.path.isfile(gen_script):
subprocess.check_call([
# Fixed interpreter/script plus an argv list (never a shell);
# csv_path/bin_path are private NamedTemporaryFile paths.
subprocess.check_call([ # nosemgrep: dangerous-subprocess-use-tainted-env-args
sys.executable, gen_script, "generate",
csv_path, bin_path, hex(size)
])