Skip to content

security: harden Syslog output and imports - #326

Open
somethingwithproof wants to merge 7 commits into
Cacti:developfrom
somethingwithproof:security/syslog-output-import-hardening
Open

security: harden Syslog output and imports#326
somethingwithproof wants to merge 7 commits into
Cacti:developfrom
somethingwithproof:security/syslog-output-import-hardening

Conversation

@somethingwithproof

@somethingwithproof somethingwithproof commented Jul 14, 2026

Copy link
Copy Markdown
Member

Summary

  • Escape stored alert content before guest-accessible rendering.
  • Prevent spreadsheet formula execution in CSV exports.
  • Cap imported XML file payloads before reading them into memory.

Validation

  • PHP 8.0 syntax checks for changed sources and regression tests.
  • issue277_import_payload_loader_test.php.
  • issue318_output_import_hardening_test.php.
  • Linux Docker integration checks across the repository CI matrix.

Compatibility

Uses PHP 8.0-compatible syntax and Cacti helper conventions.

Three defects, all failing open or failing at setup:

- the plugin syntax check redirected find's own output rather than php's, so
  PHP errors never reached the grep testing for them; the step could not fail
- MYSQL_AUTH_USR carried a literal tilde, because parameter expansion happens
  after tilde expansion, so MySQL was handed a path it could not resolve
- the Cacti checkout took the default branch, which is 1.3 in development and
  whose CLI installer currently fatals with an undefined __()

plugin_syslog additionally installed libapache2-mod-php${{ matrix.php }},
which Ubuntu does not package, so apt exited 100 before Cacti was reached.

Verified with actionlint, which is clean on the result.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
# Conflicts:
#	.github/workflows/plugin-ci-workflow.yml
@somethingwithproof
somethingwithproof marked this pull request as ready for review August 17, 2026 21:36
Copilot AI lite review requested due to automatic review settings August 17, 2026 21:36

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR hardens the Syslog plugin against common output- and import-related security issues by escaping guest-visible stored content, preventing spreadsheet formula injection in CSV exports, and limiting import payload sizes to reduce memory risk.

Changes:

  • Escape stored alert HTML before rendering in the alarm viewer.
  • Add an import payload size cap and centralize CSV cell hardening for exports.
  • Add regression coverage for the hardening and update CI to pin the Cacti checkout ref and adjust job steps.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 6 comments.

Show a summary per file
File Description
syslog.php Escapes stored alarm HTML output (and preserves newlines via nl2br).
functions.php Adds import-size guard and CSV cell hardening helper; updates CSV export to use it.
tests/regression/issue318_output_import_hardening_test.php New regression test covering CSV formula hardening + alarm viewer escaping.
tests/regression/issue277_import_payload_loader_test.php Updates regression assertions for the shared import payload loader.
.github/workflows/plugin-ci-workflow.yml Pins Cacti checkout ref and adjusts lint/dependency steps in CI.
Suppressed comments (2)

tests/regression/issue277_import_payload_loader_test.php:39

  • str_contains() is PHP 8+ only. If this repo/PR intends to remain PHP 7.4-compatible, switch this check back to strpos(...) === false.
if (!str_contains($functions, "trim(get_nfilter_request_var('import_text')) !== ''")) {

tests/regression/issue318_output_import_hardening_test.php:44

  • str_contains() is PHP 8+ only. If this repo/PR intends to remain PHP 7.4-compatible, use strpos(...) === false for this source scan (preserving the existing needle string).
if (!str_contains($syslog, 'nl2br(html_escape(trim($html, "\' ")))')) {

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread functions.php
Comment thread functions.php Outdated
Comment thread tests/regression/issue318_output_import_hardening_test.php
Comment thread tests/regression/issue318_output_import_hardening_test.php
Comment thread tests/regression/issue277_import_payload_loader_test.php
Comment thread .github/workflows/plugin-ci-workflow.yml Outdated
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants