Skip to content

Order By Vulnerability#40143

Merged
mostlikelee merged 5 commits intomainfrom
14323-order-by
Feb 23, 2026
Merged

Order By Vulnerability#40143
mostlikelee merged 5 commits intomainfrom
14323-order-by

Conversation

@mostlikelee
Copy link
Copy Markdown
Contributor

@mostlikelee mostlikelee commented Feb 20, 2026

Related issue: Resolves https://github.com/fleetdm/confidential/issues/14323

  • Implements allowlist-based validation for all list endpoints that could surface sensitive data. An eng-init issue will be created to address ALL list endpoints for future proofing.

Entpoints affected | sensitive data:

  • Hosts
  • Policies
  • Queries
  • Users
  • Invites
  • Secret Variables
  • Certificate Templates
  • Host Certificates
  • Batch Script Hosts

Checklist for submitter

If some of the following don't apply, delete the relevant line.

  • Changes file added for user-visible changes in changes/, orbit/changes/ or ee/fleetd-chrome/changes.
    See Changes files for more information.

  • Input data is properly validated, SELECT * is avoided, SQL injection is prevented (using placeholders for values in statements)

  • If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes

Testing

  • Added/updated automated tests

  • QA'd all new/changed functionality manually

@codecov
Copy link
Copy Markdown

codecov Bot commented Feb 20, 2026

Codecov Report

❌ Patch coverage is 81.73077% with 19 lines in your changes missing coverage. Please review.
✅ Project coverage is 66.34%. Comparing base (d83fd5f) to head (948cb91).
⚠️ Report is 98 commits behind head on main.

Files with missing lines Patch % Lines
server/platform/mysql/list_options.go 87.71% 5 Missing and 2 partials ⚠️
server/datastore/mysql/policies.go 66.66% 2 Missing and 2 partials ⚠️
server/datastore/mysql/certificate_templates.go 33.33% 1 Missing and 1 partial ⚠️
server/datastore/mysql/host_certificates.go 33.33% 1 Missing and 1 partial ⚠️
server/datastore/mysql/hosts.go 71.42% 1 Missing and 1 partial ⚠️
server/datastore/mysql/secret_variables.go 33.33% 1 Missing and 1 partial ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main   #40143      +/-   ##
==========================================
+ Coverage   66.31%   66.34%   +0.02%     
==========================================
  Files        2449     2452       +3     
  Lines      196520   196719     +199     
  Branches     8537     8537              
==========================================
+ Hits       130332   130505     +173     
- Misses      54379    54398      +19     
- Partials    11809    11816       +7     
Flag Coverage Δ
backend 68.13% <81.73%> (+0.02%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

listResp = listHostsResponse{}
s.DoJSON("GET", "/api/latest/fleet/hosts", nil, http.StatusOK, &listResp, "software_status", "installed", "team_id", fmt.Sprint(team.ID),
"software_title_id", fmt.Sprint(app2TitleID), "order_key", "h.id")
"software_title_id", fmt.Sprint(app2TitleID), "order_key", "id")
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

pointing this out as technically a breaking change, although I don't expect customers or the FE to use h.id

@mostlikelee mostlikelee marked this pull request as ready for review February 20, 2026 20:41
@mostlikelee mostlikelee requested a review from a team as a code owner February 20, 2026 20:41
Copy link
Copy Markdown
Member

@getvictor getvictor left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good overall. Left a couple small comments.

Comment thread server/datastore/mysql/mysql_test.go Outdated
require.NoError(t, err)
expected := "SELECT * FROM my_table ORDER BY name ASC LIMIT 1000000"
if actual != expected {
t.Errorf("got %q, want %q", actual, expected)
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should be using testify assert/require here, and other places.

Allowed []string
}

func (e InvalidOrderKeyError) Error() string {
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What error code will this return?

Can it implement IsClientError() = true interface?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

good catch, i also implemented Invalid() so this gets surfaced as a 422 err

@mostlikelee mostlikelee changed the title 14323 order by Order By Vulnerability Feb 23, 2026
@mostlikelee mostlikelee merged commit 3fd665e into main Feb 23, 2026
47 checks passed
@mostlikelee mostlikelee deleted the 14323-order-by branch February 23, 2026 16:42
mostlikelee added a commit that referenced this pull request Feb 23, 2026
mostlikelee added a commit that referenced this pull request Feb 24, 2026
@georgekarrv georgekarrv mentioned this pull request Mar 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants