From 1e32d59b8fa9dc5aa34cac128b371ccaf99cc62a Mon Sep 17 00:00:00 2001 From: John Cardinal Date: Sat, 24 Oct 2026 14:03:12 -0700 Subject: [PATCH] Security review: F43, unit pick-list variant put into SQL unparsed (found during case 4712) Also corrects the pass 6 note that all pick-list variants were parsed or matched to fixed strings. Co-Authored-By: Claude Opus 5.5 --- devdocs/modernization/SECURITY-REVIEW.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/devdocs/modernization/SECURITY-REVIEW.md b/devdocs/modernization/SECURITY-REVIEW.md index 6fd58d5d..d61db372 100644 --- a/devdocs/modernization/SECURITY-REVIEW.md +++ b/devdocs/modernization/SECURITY-REVIEW.md @@ -189,6 +189,7 @@ take the next free number; a fixed or accepted finding keeps its ID and changes | ID | Severity | Status | Title | |---|---|---|---| +| F43 | **Critical** | confirmed (code) | Unit pick-list variant (`customerid:`) is put into SQL unparsed; any logged-in user can reach it | | F41 | **Critical** | **fixed in case 4710** (Sockeye; the business server gets it with 8.3.0) | F5 also in Sockeye (internet-facing admin login) and in the 8.2.x business AyaNova server | | F42 | High | confirmed (code) | The licence-signing RSA private keys are hardcoded in Sockeye's source and binaries | | F5 | **Critical** | **fixed in case 4710** | 2FA login step accepts an empty or missing temp token: the password is skipped for users with 2FA on | @@ -819,6 +820,17 @@ OK in pass 11: no licence is issued without John's approval; a DB ID with a purc cannot request a trial; licence keys are bound to the DB ID and signed (AyaNova verifies the signature). +### F43 Unit pick-list variant in SQL (found 2026-10-24 during case 4712, from code) + +`UnitPickList.GetVariantCriteria` takes a `customerid:` variant from the request and returns +`aunit.customerid = {v[1]}`, the value unparsed, which `PickListSqlBuilder` adds to the query. The +route (`pick-list/list`, `pick-list/single`) is open to every login, customer contacts included. Same +class as F18 and F26. **Correction to pass 6:** "Raw SQL: what was checked and found safe" said the +pick-list variants were parsed as numbers or matched to fixed strings; that holds for the other six +lists with variants but not this one (the pass 6 search looked for `{variant}` and `{crit[...]}` +interpolations and missed `{v[1]}`). Fix: parse the value as a `long` and ignore the variant otherwise, +as the other lists do. + ### F2 Windows folder permissions (from the 8.3.0 installer test) `lan.iss` and `standalone.iss` set `Permissions: users-modify` on `{app}` (the program