admin/raven
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Security review: F43, unit pick-list variant put into SQL unparsed (found during case 4712)

Browse Source 
Also corrects the pass 6 note that all pick-list variants were parsed or matched
to fixed strings.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
John Cardinal
2026-10-24 14:03:12 -07:00
parent d75c3eecea
commit 1e32d59b8f
1 changed files with 12 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
devdocs/modernization/SECURITY-REVIEW.md
View File

@@ -189,6 +189,7 @@ take the next free number; a fixed or accepted finding keeps its ID and changes
| ID | Severity | Status | Title |
|---|---|---|---|
| F43 | **Critical** | confirmed (code) | Unit pick-list variant (`customerid:<value>`) is put into SQL unparsed; any logged-in user can reach it |
| F41 | **Critical** | **fixed in case 4710** (Sockeye; the business server gets it with 8.3.0) | F5 also in Sockeye (internet-facing admin login) and in the 8.2.x business AyaNova server |
| F42 | High | confirmed (code) | The licence-signing RSA private keys are hardcoded in Sockeye's source and binaries |
| F5 | **Critical** | **fixed in case 4710** | 2FA login step accepts an empty or missing temp token: the password is skipped for users with 2FA on |
@@ -819,6 +820,17 @@ OK in pass 11: no licence is issued without John's approval; a DB ID with a purc
cannot request a trial; licence keys are bound to the DB ID and signed (AyaNova verifies the
signature).
### F43 Unit pick-list variant in SQL (found 2026-10-24 during case 4712, from code)
`UnitPickList.GetVariantCriteria` takes a `customerid:<value>` variant from the request and returns
`aunit.customerid = {v[1]}`, the value unparsed, which `PickListSqlBuilder` adds to the query. The
route (`pick-list/list`, `pick-list/single`) is open to every login, customer contacts included. Same
class as F18 and F26. **Correction to pass 6:** "Raw SQL: what was checked and found safe" said the
pick-list variants were parsed as numbers or matched to fixed strings; that holds for the other six
lists with variants but not this one (the pass 6 search looked for `{variant}` and `{crit[...]}`
interpolations and missed `{v[1]}`). Fix: parse the value as a `long` and ignore the variant otherwise,
as the other lists do.
### F2 Windows folder permissions (from the 8.3.0 installer test)
`lan.iss` and `standalone.iss` set `Permissions: users-modify` on `{app}` (the program