mirror of
https://github.com/azaion/satellite-provider.git
synced 2026-06-21 14:21:14 +00:00
Oleksandr Bezdieniezhnykh
51b572108a
Captures the post-implementation autodev gates for AZ-484 multi-source tile storage: - Step 12 (Test-Spec Sync): added 7 AC rows (AZ-484 AC-1..AC-7) and a PT-07 NFR row to traceability-matrix.md; added PT-07 scenario to performance-tests.md. - Step 13 (Update Docs): refreshed data_model.md (tiles columns + indexes + selection rule + UPSERT contract + migrations 012/013), module-layout.md (Common/Enums section with L-001 guidance, DataAccess imports-from now lists 6 sites), 6 module / component docs to reflect the new repo signatures, source/captured_at fields, and Dapper enum bypass workaround. ripple_log_cycle1.md records zero out-of-scope ripple. - Step 14 (Security Audit): PASS_WITH_WARNINGS - 0 Critical, 0 High, 5 Medium, 5 Low. AZ-484 itself added zero new findings. Hardening items (Postgres default creds, .env in build context, GMaps key rotation, ASP.NET Core 8.0.21 -> 8.0.25, rate limiter) recorded for separate tickets. - Step 15 (Performance Test): all PT-01..PT-07 scenarios Unverified (non-blocking); PT-07 baseline-comparison harness deferred to a leftover for next cycle. - Step 16 (Deploy): cycle deploy report covering migration safety, rollback path, post-deploy verification, security caveats. Co-authored-by: Cursor <cursoragent@cursor.com>
66 lines
4.5 KiB
Markdown
66 lines
4.5 KiB
Markdown
# Phase 1 — Dependency Scan
|
|
|
|
**Date**: 2026-05-11
|
|
**Method**: Manual inventory from `*.csproj` + targeted advisory search (WebSearch against GHSA / NVD / NuGet ReversingLabs).
|
|
**Reason for manual mode**: `dotnet list package --vulnerable` is on the project's "do not run from agent" list (AGENTS.md — these commands hang in this environment).
|
|
|
|
## Inventory
|
|
|
|
| Project | Package | Version | Notes |
|
|
|---------|---------|---------|-------|
|
|
| Api | Microsoft.AspNetCore.OpenApi | 8.0.21 | ASP.NET Core 8 LTS patch (one behind 8.0.25) |
|
|
| Api | Newtonsoft.Json | 13.0.4 | Latest 13.x |
|
|
| Api | Serilog.AspNetCore | 8.0.3 | |
|
|
| Api | Serilog.Sinks.File | 6.0.0 | |
|
|
| Api | SixLabors.ImageSharp | 3.1.11 | |
|
|
| Api | Swashbuckle.AspNetCore | 6.6.2 | |
|
|
| Common | SixLabors.ImageSharp | 3.1.11 | |
|
|
| DataAccess | Dapper | 2.1.35 | |
|
|
| DataAccess | Npgsql | 9.0.2 | |
|
|
| DataAccess | dbup-postgresql | 6.0.3 | |
|
|
| DataAccess | Microsoft.Extensions.Configuration.Abstractions | 9.0.10 | |
|
|
| DataAccess | Microsoft.Extensions.Logging.Abstractions | 9.0.10 | |
|
|
| TileDownloader | Microsoft.Extensions.Caching.Memory | 9.0.10 | |
|
|
| TileDownloader | Microsoft.Extensions.Http | 9.0.10 | |
|
|
| TileDownloader | Microsoft.Extensions.Logging.Abstractions | 9.0.10 | |
|
|
| TileDownloader | Microsoft.Extensions.Options.ConfigurationExtensions | 9.0.10 | |
|
|
| TileDownloader | Newtonsoft.Json | 13.0.4 | |
|
|
| Tests | coverlet.collector | 6.0.0 | |
|
|
| Tests | FluentAssertions | 8.8.0 | |
|
|
| Tests | Microsoft.Extensions.* | 9.0.10 | (multiple) |
|
|
| Tests | Microsoft.NET.Test.Sdk | 17.8.0 | NuGet.Frameworks transitive CVE flag — see findings |
|
|
| Tests | Moq | 4.20.72 | |
|
|
| Tests | xunit | 2.5.3 | |
|
|
| Tests | xunit.runner.visualstudio | 2.5.3 | |
|
|
|
|
## Findings
|
|
|
|
| # | Severity | Package | Version | Advisory | Disposition |
|
|
|---|----------|---------|---------|----------|-------------|
|
|
| D1 | Medium (production-risk: **Low**, exposure: not reachable) | Microsoft.AspNetCore.OpenApi → ASP.NET Core 8 runtime | 8.0.21 | [CVE-2026-26130](https://github.com/dotnet/aspnetcore/security/advisories/GHSA-4vgm-c2wm-63mw) — SignalR DoS via unbounded buffer | **Not exploitable in this app**: codebase grep for `SignalR\|MapHub\|UseSignalR\|HubConnection` returns zero hits. Runtime patch still recommended. Upgrade `Microsoft.AspNetCore.OpenApi` to `8.0.25` (or current 8.0.x patch) and redeploy on a runtime ≥ 8.0.25 to remove the vulnerable code paths from the deployed image. |
|
|
| D2 | Low (test-only) | Microsoft.NET.Test.Sdk | 17.8.0 | [CVE-2022-30184](https://github.com/microsoft/vstest/issues/4409) via transitive `NuGet.Frameworks <6.2.1` — information disclosure (CVSS 5.5) | **Not exploitable in production**: package is `IsTestProject=true` only; never shipped. Upgrade to `Microsoft.NET.Test.Sdk` ≥ 17.9.0 (which dropped the `NuGet.Frameworks` dependency entirely) the next time the test project's deps are touched. |
|
|
|
|
## Cross-version sanity (per `coderule.mdc`: keep dependency versions consistent)
|
|
|
|
- `Microsoft.Extensions.*` is uniformly **9.0.10** across DataAccess, TileDownloader, Tests, RegionProcessing, RouteManagement — consistent. ✓
|
|
- `Newtonsoft.Json` is **13.0.4** in both Api and TileDownloader — consistent. ✓
|
|
- `SixLabors.ImageSharp` is **3.1.11** in both Api and Common — consistent. ✓
|
|
- ASP.NET Core meta-package level is at **8.0.21** while extensions are at 9.0.10. The 9.x extensions ship a forward-compatible netstandard2.0 surface and load fine on the .NET 8 runtime — no functional issue, but worth flagging as a minor consistency drift for whoever next bumps the framework.
|
|
|
|
## Items checked clean
|
|
|
|
- SixLabors.ImageSharp 3.1.11 — newer than the patched 3.1.7 / 3.1.5 lines (CVE-2024-41131, CVE-2025-27598). No outstanding GHSA against 3.1.11 itself.
|
|
- Newtonsoft.Json 13.0.4 — past CVE-2024-21907 fix line (13.0.1).
|
|
- Npgsql 9.0.2 — outside the 4.x / 5.x / 6.x / 7.x / 8.x ranges affected by CVE-2024-32655 (SQL injection via protocol message size overflow). 9.0.x line was never affected.
|
|
- Dapper 2.1.35 — only "advisory" hit was a dependency-check false positive for SQLite CVE-2017-10989; not a Dapper issue.
|
|
- Swashbuckle.AspNetCore 6.6.2 — no published GHSA / CVE.
|
|
- Serilog.AspNetCore 8.0.3 — no published GHSA / CVE.
|
|
- dbup-postgresql 6.0.3 — no published GHSA / CVE.
|
|
|
|
## Self-verification
|
|
|
|
- [x] All package manifests scanned (8 csproj files)
|
|
- [x] Each finding has a CVE ID or advisory reference
|
|
- [x] Upgrade paths identified for every Medium/Low finding
|
|
- [x] No Critical or High finding remains open after exploitability triage
|