Repository navigation
Conversation
…d private key - api_url(): require https + official catlinks.cn hosts (or the configured api_base host). Closes a credential-exfiltration path: the request_api entity service accepted any absolute URL and would send the session token to it (SSRF with creds). - request(): never mutate the caller's params dict - the injected token/sign were leaking into every device-action log that printed its params ([rdt, pms] in base/litterbox/c08/feeder/purepro). - Failed-login, request-failure and response logs no longer dump credentials/tokens/params/bodies (returnCode + message only). - const.py: remove unused RSA_PRIVATE_KEY (dead code, but a private key committed to a public repo is a red flag). - README: replace the 'wget -O - https://get.hacs.vip | bash' install methods with plain download instructions (remote code execution). - tests: host-allowlist cases + caller-dict non-mutation regression test.
…y registered; old list omitted 'number')
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Static security review of this integration surfaced four credential/network issues, all fixed here with tests. The most concrete: the
request_apientity service accepts any absolute URL (api_url()returned it as-is), and every request attaches the session token — so any automation (or anyone who can call services) could make Home Assistant POST your CatLink session token to a third-party server and echo the response back (throw: true). Combined with params-dict mutation, the token also leaked into every device-action log line.What
api_url()host allowlist — https only, host must be an official*.catlinks.cndomain or the user-configuredapi_basehost. Relative paths (every internal call site) behave exactly as before.request()no longer mutates the caller's params dict — it previously injectedtoken/sign/noncestrin place, so every device command that logs its params ([rdt, pms]in devices/base, litterbox, c08, feeder, purepro) wrote the live session token to the HA log.returnCodeonly, not full bodies.RSA_PRIVATE_KEYfromconst.py— dead code, nothing references it, but a private key committed to a public repo is a red flag for anyone scanning the codebase.wget -O - https://get.hacs.vip | ... bash -install methods (remote code execution) with release-download instructions, plus a note warning against the old pattern.Tests
tests/test_platforms.py: fixes a pre-existing broken assertion (it hardcoded five domains and omittednumber, added in fix: Add 'number' to component types list #59) — same change as in the entity-domain PR, identical content so the merges won't conflict.Full suite on this branch: 226 passed (Python 3.13, pytest-homeassistant-custom-component per requirements_test).