Skip to content

WebVigil 1.0.1

Choose a tag to compare

View all tags
@ryanvmorais ryanvmorais released this 08 Oct 15:07
· 37 commits to main since this release
v1.0.1
cfa2e08
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Patch release: it hardens the optional Web API and lifts the selectolax cap. The CLI, the exit codes, the configuration keys, the check ids and the JSON report do not change.

  • Web API: it refuses at start a pinned session_secret shorter than 32 characters and a * in cors_origins, and an unauthenticated request can no longer make it hold memory in proportion to its size (a body over 1 MiB is answered with 413, the login fields are capped). If you pinned a shorter secret, generate a longer one before upgrading.
  • Login takes the same time for a username that does not exist as for a wrong password, and an out-of-range scan id is a 422, not a 500.
  • HTML is parsed with the Lexbor backend of selectolax (selectolax>=1.0.0,<2); a full Active scan of the bundled test app gives the same findings.
  • Windows: a report redirected from stdout is UTF-8, so webvigil report can read it back.
  • Upgrade: pipx upgrade webvigil, or docker pull ghcr.io/ryanvmorais/webvigil:1.0.1.

Scan only systems you own or have permission to test. The compatibility promise is in docs/stability.md.

Security advisory: GHSA-vw64-75mj-x37q

Full list of what changed in 1.0.1: CHANGELOG

Assets 2
Loading