- Created `qa-test-output-after-fix.txt` and `qa-test-output.txt` to log results of certificate page authentication tests.
- Added `build.sh` for deterministic backend builds in CI, utilizing `go list` for efficiency.
- Introduced `codeql_scan.sh` for CodeQL database creation and analysis for Go and JavaScript/TypeScript.
- Implemented `dockerfile_check.sh` to validate Dockerfiles for base image and package manager mismatches.
- Added `sourcery_precommit_wrapper.sh` to facilitate Sourcery CLI usage in pre-commit hooks.
CodeQL flagged critical vulnerabilities in mail_service.go where
untrusted input could be used to inject additional email headers
via CRLF sequences.
Changes:
- Add sanitizeEmailHeader() to strip CR, LF, and control characters
- Sanitize all header values (from, to, subject) in buildEmail()
- Add validateEmailAddress() using net/mail.ParseAddress
- Add comprehensive security tests for header injection prevention
This addresses the 3 critical CodeQL alerts:
- Line 199: buildEmail header construction
- Line 260: sendSSL message usage
- Line 307: sendSTARTTLS message usage
Security: CWE-93 (Improper Neutralization of CRLF Sequences)
- Added a new SMTP settings page with functionality to configure SMTP settings, test connections, and send test emails.
- Implemented user management page to list users, invite new users, and manage user permissions.
- Created modals for inviting users and editing user permissions.
- Added tests for the new SMTP settings and user management functionalities.
- Updated navigation to include links to the new SMTP settings and user management pages.
GitHub Actions