develop

[sou-chon]

No description provided.

[lgtm-com]

This pull request fixes 24 alerts when merging 20aed48 into 4ceee58 - view on LGTM.com

fixed alerts:

• 19 for Unused variable, import, function or class
• 1 for Duplicate switch case
• 1 for Unreachable statement
• 1 for Variable not declared before use
• 1 for Ignoring result from pure array method
• 1 for Hard-coded credentials

[lgtm-com]

This pull request fixes 24 alerts when merging 4e87744 into 4ceee58 - view on LGTM.com

fixed alerts:

• 19 for Unused variable, import, function or class
• 1 for Duplicate switch case
• 1 for Unreachable statement
• 1 for Variable not declared before use
• 1 for Ignoring result from pure array method
• 1 for Hard-coded credentials

[lgtm-com]

This pull request fixes 24 alerts when merging bd6a33e into 4ceee58 - view on LGTM.com

fixed alerts:

• 19 for Unused variable, import, function or class
• 1 for Duplicate switch case
• 1 for Unreachable statement
• 1 for Variable not declared before use
• 1 for Ignoring result from pure array method
• 1 for Hard-coded credentials

[lgtm-com]

This pull request fixes 24 alerts when merging d2cecbd into 4ceee58 - view on LGTM.com

fixed alerts:

• 19 for Unused variable, import, function or class
• 1 for Duplicate switch case
• 1 for Unreachable statement
• 1 for Variable not declared before use
• 1 for Ignoring result from pure array method
• 1 for Hard-coded credentials

[lgtm-com]

This pull request fixes 24 alerts when merging a36f68c into 4ceee58 - view on LGTM.com

fixed alerts:

• 19 for Unused variable, import, function or class
• 1 for Duplicate switch case
• 1 for Unreachable statement
• 1 for Variable not declared before use
• 1 for Ignoring result from pure array method
• 1 for Hard-coded credentials

[lgtm-com]

This pull request fixes 24 alerts when merging 3cde989 into 4ceee58 - view on LGTM.com

fixed alerts:

• 19 for Unused variable, import, function or class
• 1 for Duplicate switch case
• 1 for Unreachable statement
• 1 for Variable not declared before use
• 1 for Ignoring result from pure array method
• 1 for Hard-coded credentials

[lgtm-com]

This pull request fixes 24 alerts when merging 6a168cb into 4ceee58 - view on LGTM.com

fixed alerts:

• 19 for Unused variable, import, function or class
• 1 for Duplicate switch case
• 1 for Unreachable statement
• 1 for Variable not declared before use
• 1 for Ignoring result from pure array method
• 1 for Hard-coded credentials

[lgtm-com]

This pull request fixes 24 alerts when merging 0e1bd29 into 4ceee58 - view on LGTM.com

fixed alerts:

• 19 for Unused variable, import, function or class
• 1 for Duplicate switch case
• 1 for Unreachable statement
• 1 for Variable not declared before use
• 1 for Ignoring result from pure array method
• 1 for Hard-coded credentials

[lgtm-com]

This pull request fixes 24 alerts when merging ce2993e into 4ceee58 - view on LGTM.com

fixed alerts:

• 19 for Unused variable, import, function or class
• 1 for Duplicate switch case
• 1 for Unreachable statement
• 1 for Variable not declared before use
• 1 for Ignoring result from pure array method
• 1 for Hard-coded credentials

[lgtm-com]

This pull request fixes 24 alerts when merging 5cb5e66 into 4ceee58 - view on LGTM.com

fixed alerts:

• 19 for Unused variable, import, function or class
• 1 for Duplicate switch case
• 1 for Unreachable statement
• 1 for Variable not declared before use
• 1 for Ignoring result from pure array method
• 1 for Hard-coded credentials

[lgtm-com]

This pull request fixes 24 alerts when merging aa94aa1 into 4ceee58 - view on LGTM.com

fixed alerts:

• 19 for Unused variable, import, function or class
• 1 for Duplicate switch case
• 1 for Unreachable statement
• 1 for Variable not declared before use
• 1 for Ignoring result from pure array method
• 1 for Hard-coded credentials

[lgtm-com]

This pull request fixes 24 alerts when merging a42665b into 4ceee58 - view on LGTM.com

fixed alerts:

• 19 for Unused variable, import, function or class
• 1 for Duplicate switch case
• 1 for Unreachable statement
• 1 for Variable not declared before use
• 1 for Ignoring result from pure array method
• 1 for Hard-coded credentials

[lgtm-com]

This pull request fixes 24 alerts when merging 1d924e9 into 4ceee58 - view on LGTM.com

fixed alerts:

• 19 for Unused variable, import, function or class
• 1 for Duplicate switch case
• 1 for Unreachable statement
• 1 for Variable not declared before use
• 1 for Ignoring result from pure array method
• 1 for Hard-coded credentials

[lgtm-com]

This pull request fixes 24 alerts when merging 51602ec into 4ceee58 - view on LGTM.com

fixed alerts:

• 19 for Unused variable, import, function or class
• 1 for Duplicate switch case
• 1 for Unreachable statement
• 1 for Variable not declared before use
• 1 for Ignoring result from pure array method
• 1 for Hard-coded credentials

[lgtm-com]

This pull request fixes 24 alerts when merging 4520f1f into 4ceee58 - view on LGTM.com

fixed alerts:

• 19 for Unused variable, import, function or class
• 1 for Duplicate switch case
• 1 for Unreachable statement
• 1 for Variable not declared before use
• 1 for Ignoring result from pure array method
• 1 for Hard-coded credentials

[lgtm-com]

This pull request fixes 24 alerts when merging 1c097d7 into 4ceee58 - view on LGTM.com

fixed alerts:

• 19 for Unused variable, import, function or class
• 1 for Duplicate switch case
• 1 for Unreachable statement
• 1 for Variable not declared before use
• 1 for Ignoring result from pure array method
• 1 for Hard-coded credentials

[lgtm-com]

This pull request fixes 24 alerts when merging 3daa64a into 4ceee58 - view on LGTM.com

fixed alerts:

• 19 for Unused variable, import, function or class
• 1 for Duplicate switch case
• 1 for Unreachable statement
• 1 for Variable not declared before use
• 1 for Ignoring result from pure array method
• 1 for Hard-coded credentials

[lgtm-com]

This pull request fixes 24 alerts when merging b89c3f9 into 4ceee58 - view on LGTM.com

fixed alerts:

• 19 for Unused variable, import, function or class
• 1 for Duplicate switch case
• 1 for Unreachable statement
• 1 for Variable not declared before use
• 1 for Ignoring result from pure array method
• 1 for Hard-coded credentials

[lgtm-com]

This pull request fixes 24 alerts when merging 3726e6e into 4ceee58 - view on LGTM.com

fixed alerts:

• 19 for Unused variable, import, function or class
• 1 for Duplicate switch case
• 1 for Unreachable statement
• 1 for Variable not declared before use
• 1 for Ignoring result from pure array method
• 1 for Hard-coded credentials

[lgtm-com]

This pull request fixes 24 alerts when merging 1e5a05c into 4ceee58 - view on LGTM.com

fixed alerts:

• 19 for Unused variable, import, function or class
• 1 for Duplicate switch case
• 1 for Unreachable statement
• 1 for Variable not declared before use
• 1 for Ignoring result from pure array method
• 1 for Hard-coded credentials

[lgtm-com]

This pull request fixes 24 alerts when merging 1b0a87d into 4ceee58 - view on LGTM.com

fixed alerts:

• 19 for Unused variable, import, function or class
• 1 for Duplicate switch case
• 1 for Unreachable statement
• 1 for Variable not declared before use
• 1 for Ignoring result from pure array method
• 1 for Hard-coded credentials

[lgtm-com]

This pull request fixes 24 alerts when merging b5c7c9c into 4ceee58 - view on LGTM.com

fixed alerts:

• 19 for Unused variable, import, function or class
• 1 for Duplicate switch case
• 1 for Unreachable statement
• 1 for Variable not declared before use
• 1 for Ignoring result from pure array method
• 1 for Hard-coded credentials

[lgtm-com]

This pull request fixes 24 alerts when merging 695e9a8 into 4ceee58 - view on LGTM.com

fixed alerts:

• 19 for Unused variable, import, function or class
• 1 for Duplicate switch case
• 1 for Unreachable statement
• 1 for Variable not declared before use
• 1 for Ignoring result from pure array method
• 1 for Hard-coded credentials

[lgtm-com]

This pull request fixes 24 alerts when merging 37a5855 into 4ceee58 - view on LGTM.com

fixed alerts:

• 19 for Unused variable, import, function or class
• 1 for Duplicate switch case
• 1 for Unreachable statement
• 1 for Variable not declared before use
• 1 for Ignoring result from pure array method
• 1 for Hard-coded credentials

[lgtm-com]

This pull request fixes 24 alerts when merging 41b7bed into 4ceee58 - view on LGTM.com

fixed alerts:

• 19 for Unused variable, import, function or class
• 1 for Duplicate switch case
• 1 for Unreachable statement
• 1 for Variable not declared before use
• 1 for Ignoring result from pure array method
• 1 for Hard-coded credentials

[lgtm-com]

This pull request fixes 24 alerts when merging 166301b into 4ceee58 - view on LGTM.com

fixed alerts:

• 19 for Unused variable, import, function or class
• 1 for Duplicate switch case
• 1 for Unreachable statement
• 1 for Variable not declared before use
• 1 for Ignoring result from pure array method
• 1 for Hard-coded credentials

[lgtm-com]

This pull request fixes 24 alerts when merging 2fe71b3 into 4ceee58 - view on LGTM.com

fixed alerts:

• 19 for Unused variable, import, function or class
• 1 for Duplicate switch case
• 1 for Unreachable statement
• 1 for Variable not declared before use
• 1 for Ignoring result from pure array method
• 1 for Hard-coded credentials

[lgtm-com]

This pull request fixes 24 alerts when merging 77a8995 into 4ceee58 - view on LGTM.com

fixed alerts:

• 19 for Unused variable, import, function or class
• 1 for Duplicate switch case
• 1 for Unreachable statement
• 1 for Variable not declared before use
• 1 for Ignoring result from pure array method
• 1 for Hard-coded credentials

[lgtm-com]

This pull request fixes 24 alerts when merging 32307dc into 4ceee58 - view on LGTM.com

fixed alerts:

• 19 for Unused variable, import, function or class
• 1 for Duplicate switch case
• 1 for Unreachable statement
• 1 for Variable not declared before use
• 1 for Ignoring result from pure array method
• 1 for Hard-coded credentials

[lgtm-com]

This pull request fixes 24 alerts when merging e38b8f1 into 4ceee58 - view on LGTM.com

fixed alerts:

• 19 for Unused variable, import, function or class
• 1 for Duplicate switch case
• 1 for Unreachable statement
• 1 for Variable not declared before use
• 1 for Ignoring result from pure array method
• 1 for Hard-coded credentials

The best way to fix this problem is to add a permissions: block at the appropriate scope to the workflow YAML, specifying only the minimum required permissions. Since this workflow does not appear to require any ability to modify repository contents, and only needs to read source code, you should set contents: read, either at the root level (affecting all jobs), or inside the build job (if you later add other jobs requiring different permissions). For this workflow, root-level is best. The change is to insert a block:

permissions:
  contents: read

...directly after the workflow name: and before the on: trigger in .github/workflows/99_ci.yml. No other imports/methods/definitions are needed.

To fix the issue, add an explicit permissions: block to the workflow to limit the GITHUB_TOKEN privileges. For CodeQL analysis workflows, it is standard to grant read-only access to repository contents (contents: read) and write access only to security-events (needed to upload CodeQL results). The best place to add this block is at the root level of the workflow (before jobs:), so it applies to all jobs unless overridden.

• Edit the file .github/workflows/codeql.yml.
• Insert a block like this before the jobs: key:

  permissions:
    contents: read
    security-events: write
  

No other imports or definitions are necessary, as this is a configuration change.

---

To address this vulnerability, every property name assignment derived from untrusted input must be protected against common prototype-polluting keys: __proto__, constructor, and prototype. The specific fix is to prevent any such keys from being used as property names in the insertInObj recursive function. This can be done either by skipping assignments with those keys or by throwing an error.

Implementation steps:

• Edit insertInObj in packages/itmat-cores/src/utils/query.ts.
• Before any property assignment (pointer[modifiedLevel] = ...), check if modifiedLevel is one of the dangerous names. If so, skip that iteration or throw an error, depending on desired behavior (usually, skip).
• Optionally, define a helper function for this key check for clarity.
• No changes needed outside the shown code.

---

To fix this vulnerability, we need to ensure that dangerous property names are never used as keys when assigning properties to objects in the insertInObj function. The best approaches are:

• Preferred approach: Before assigning to pointer[modifiedLevel], check that modifiedLevel is not "__proto__", "constructor", or "prototype". If it matches, skip assignment or throw an error.
• Alternative: Use a safer associative structure (such as Map objects, or objects without prototypes Object.create(null)), but this may require more invasive changes for compatibility.

Given the code's existing usage of plain objects, the simplest non-breaking fix is to add a guard in insertInObj before any assignment to pointer[modifiedLevel] (lines 363, 370, and 371). This can be accomplished by adding a function to check for these dangerous property names, and skipping assignment for them.

Edits:

• Add a utility function (locally in the file, near insertInObj) to check for dangerous keys.
• In insertInObj, before every assignment to pointer[modifiedLevel] (lines 363, 370, and 371), add a check: if modifiedLevel is dangerous, skip the assignment, optionally log or throw.
• No external dependencies are needed.
• Edits are localized to insertInObj.

---

The best fix is to prevent property names that could cause prototype pollution (such as __proto__, constructor, or prototype) from being used as keys in objects.
To do this, in the insertInObj function, add a restriction to skip or throw an error if any modifiedLevel is one of these dangerous names.
The check should be applied right after determining the value of modifiedLevel and before using it to access or assign properties on the object.
No changes are needed to function signatures, but the check should be consistently applied within the property assignment loop to fully mitigate prototype pollution.

---

The best way to fix this problem is to prevent user-controlled keys from polluting object prototypes. There are two main approaches:

1. Use a Map object for proxyCache. The ES6 Map structure does not have special prototype properties, and keys are safe regardless of their string value—so setting Map.set('__proto__', ...) will not impact prototypes.
2. Sanitize input to prevent prototype-related keys from being used. By checking if instance_id is '__proto__', 'constructor', or 'prototype', and rejecting or handling such requests, you can avoid prototype pollution.

The single best solution is to switch proxyCache from an object to an ES6 Map, and adjust property access to use Map methods (get, set, etc.). This fixes the root cause and avoids the need for sanitization. All object lookups and assignments to proxyCache need to be switched to Map method calls (like .get(), .set(), .has()). Any for-in/object enumeration should also be updated as needed.

Required changes:

• Update the definition of proxyCache.
• Replace all uses of proxyCache[instance_id] with proxyCache.get(instance_id) or proxyCache.set(instance_id, value) (including the assignment on line 558).
• Ensure the proxy cache cleanup logic is compatible with Map.
• No new dependencies are required.

---

The best and safest way to fix this issue is to use a Map object instead of a plain JavaScript object for vncProxyCache. Map is resilient to arbitrary property names, including those that conflict with built-in object properties like __proto__, constructor, or prototype.

This change will require:

• Updating the definition and initialization of vncProxyCache from an object literal {} to new Map().
• Replacing all property access and assignment patterns, e.g., vncProxyCache[instance_id], with the appropriate Map methods: get(instance_id), set(instance_id, value), and so forth.

All code interacting with vncProxyCache must be updated accordingly, but only the relevant shown code region in packages/itmat-interface/src/lxd/index.ts (bounded by snippet) can be edited.

No new external dependency is required, as Map is part of standard JavaScript.

---

The best fix is to avoid exposing the error object (e) directly to the end user in the HTTP response, as this may include sensitive information such as stack traces or internal server errors. Instead, the catch block should:

• Return a generic error message to the client, such as "Internal server error" or "An unexpected error occurred".
• Log the detailed error information (e, including stack traces if present) to the server log, which is already being done via the log_collection.insertOne.

To implement this:

• In the catch block, replace res.status(500).json(e); with res.status(500).json({ error: 'An unexpected error occurred' });, or a similarly generic message.
• No changes to imports are required.
• No other code needs to be changed.