The XSS rule only modelled request variables, so stored text such as device
descriptions, graph titles, notes, SNMP strings and plugin hook output was
never reported. form_selectable_cell() prints its contents verbatim and had no
rule at all.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* fix(a11y): [develop] correct labels, document semantics and duplicate IDs
Associates form controls with their labels, replaces obsolete tt markup, removes duplicate element IDs, and adds a native accessibility browser suite with its database fixture.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* fix(a11y): validate label IDs and recognize attribute escaping
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---------
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* ci(security): treat grv() and gnrv() as Semgrep request sources
The gating XSS rule missed the short request helpers, the header() rule trusted HTML escapers that do not stop an off-site redirect, and the advisory taint rules missed get_request_var().
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* ci(security): gate Semgrep on new findings for every event
The new sources also match values an earlier gfrv() validated, so a whole-tree result cannot gate pushes; a single job keeps results stable run to run.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---------
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* ci(security): add Cacti-aware Semgrep taint rules
Off-the-shelf PHP SAST does not model Cacti's request helpers, escaping
wrappers, or db_* API, so it misses request-variable to SQL/shell/RRDtool
flows and flags htmle()-escaped output as false positives. These rules teach
the scanner Cacti's sources (grv/gnrv), sanitizers (db_qstr, sanitize_sql_column,
cacti_escapeshellarg, html_escape, casts) and sinks. The SQL rule independently
flags the host_id sink in lib/html_graph.php.
The rule self-test is a hard gate; the whole-tree scan is advisory and its
findings go to the code-scanning tab (grv() is validated where a filter is
registered, which Semgrep cannot see, and taint over large files is not
deterministic enough for a pass/fail baseline).
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---------
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Co-authored-by: TheWitness <thewitness@cacti.net>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Thomas Vincent