Skip to content

Security: patch critical vulnerabilities and remove hardcoded secrets - #2566

Open
gorevyoneticisi wants to merge 16 commits into
IceWhaleTech:mainfrom
gorevyoneticisi:security-fixes
Open

gorevyoneticisi wants to merge 16 commits into
IceWhaleTech:mainfrom
gorevyoneticisi:security-fixes

refactor: replace archiver/v3 with stdlib archive/zip and archive/tar

0b24b77
Select commit
Loading
Failed to load commit list.
SonarQubeCloud / SonarCloud Code Analysis failed Aug 4, 2026 in 26s

Quality Gate failed

Failed conditions
5.5% Duplication on New Code (required ≤ 3%)
E Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

Annotations

Check warning on line 138 in build/sysroot/usr/share/casaos/shell/helper.sh

See this annotation in the file changed.

@sonarqubecloud sonarqubecloud / SonarCloud Code Analysis

Assign this positional parameter to a local variable.

See more on https://sonarcloud.io/project/issues?id=IceWhaleTech_CasaOS&issues=AZ_ObZFJYxMmyirvnWPx&open=AZ_ObZFJYxMmyirvnWPx&pullRequest=2566

Check warning on line 245 in build/sysroot/usr/share/casaos/shell/helper.sh

See this annotation in the file changed.

@sonarqubecloud sonarqubecloud / SonarCloud Code Analysis

Add an explicit return statement at the end of the function.

See more on https://sonarcloud.io/project/issues?id=IceWhaleTech_CasaOS&issues=AZ_ObZFJYxMmyirvnWP-&open=AZ_ObZFJYxMmyirvnWP-&pullRequest=2566

Check warning on line 317 in build/sysroot/usr/share/casaos/shell/helper.sh

See this annotation in the file changed.

@sonarqubecloud sonarqubecloud / SonarCloud Code Analysis

Add an explicit return statement at the end of the function.

See more on https://sonarcloud.io/project/issues?id=IceWhaleTech_CasaOS&issues=AZ_ObZFJYxMmyirvnWQM&open=AZ_ObZFJYxMmyirvnWQM&pullRequest=2566

Check warning on line 164 in pkg/utils/file/file.go

See this annotation in the file changed.

@sonarqubecloud sonarqubecloud / SonarCloud Code Analysis

Group together these consecutive parameters of the same type.

See more on https://sonarcloud.io/project/issues?id=IceWhaleTech_CasaOS&issues=AZ_ObZFsYxMmyirvnWQn&open=AZ_ObZFsYxMmyirvnWQn&pullRequest=2566

Check failure on line 58 in build/sysroot/usr/share/casaos/shell/helper.sh

See this annotation in the file changed.

@sonarqubecloud sonarqubecloud / SonarCloud Code Analysis

Use '[[' instead of '[' for conditional tests. The '[[' construct is safer and more feature-rich.

See more on https://sonarcloud.io/project/issues?id=IceWhaleTech_CasaOS&issues=AZ_ObZFJYxMmyirvnWPG&open=AZ_ObZFJYxMmyirvnWPG&pullRequest=2566

Check warning on line 354 in build/sysroot/usr/share/casaos/shell/helper.sh

See this annotation in the file changed.

@sonarqubecloud sonarqubecloud / SonarCloud Code Analysis

Assign this positional parameter to a local variable.

See more on https://sonarcloud.io/project/issues?id=IceWhaleTech_CasaOS&issues=AZ_ObZFJYxMmyirvnWQd&open=AZ_ObZFJYxMmyirvnWQd&pullRequest=2566

Check warning on line 340 in build/sysroot/usr/share/casaos/shell/helper.sh

See this annotation in the file changed.

@sonarqubecloud sonarqubecloud / SonarCloud Code Analysis

Function 'EditSmabaUserPassword' should be named in snake case.

See more on https://sonarcloud.io/project/issues?id=IceWhaleTech_CasaOS&issues=AZ_ObZFJYxMmyirvnWQT&open=AZ_ObZFJYxMmyirvnWQT&pullRequest=2566

Check warning on line 100 in build/sysroot/usr/share/casaos/shell/helper.sh

See this annotation in the file changed.

@sonarqubecloud sonarqubecloud / SonarCloud Code Analysis

Function 'AddPartition' should be named in snake case.

See more on https://sonarcloud.io/project/issues?id=IceWhaleTech_CasaOS&issues=AZ_ObZFJYxMmyirvnWPd&open=AZ_ObZFJYxMmyirvnWPd&pullRequest=2566

Check warning on line 65 in build/sysroot/usr/share/casaos/shell/helper.sh

See this annotation in the file changed.

@sonarqubecloud sonarqubecloud / SonarCloud Code Analysis

Function 'GetLocalJoinNetworks' should be named in snake case.

See more on https://sonarcloud.io/project/issues?id=IceWhaleTech_CasaOS&issues=AZ_ObZFJYxMmyirvnWPJ&open=AZ_ObZFJYxMmyirvnWPJ&pullRequest=2566

Check warning on line 105 in build/sysroot/usr/share/casaos/shell/helper.sh

See this annotation in the file changed.

@sonarqubecloud sonarqubecloud / SonarCloud Code Analysis

Assign this positional parameter to a local variable.

See more on https://sonarcloud.io/project/issues?id=IceWhaleTech_CasaOS&issues=AZ_ObZFJYxMmyirvnWPh&open=AZ_ObZFJYxMmyirvnWPh&pullRequest=2566

Check warning on line 142 in build/sysroot/usr/share/casaos/shell/helper.sh

See this annotation in the file changed.

@sonarqubecloud sonarqubecloud / SonarCloud Code Analysis

Function 'AutoRemoveUnuseDir' should be named in snake case.

See more on https://sonarcloud.io/project/issues?id=IceWhaleTech_CasaOS&issues=AZ_ObZFJYxMmyirvnWPy&open=AZ_ObZFJYxMmyirvnWPy&pullRequest=2566

Check warning on line 335 in build/sysroot/usr/share/casaos/shell/helper.sh

See this annotation in the file changed.

@sonarqubecloud sonarqubecloud / SonarCloud Code Analysis

Add an explicit return statement at the end of the function.

See more on https://sonarcloud.io/project/issues?id=IceWhaleTech_CasaOS&issues=AZ_ObZFJYxMmyirvnWQS&open=AZ_ObZFJYxMmyirvnWQS&pullRequest=2566

Check warning on line 4 in build/sysroot/usr/share/casaos/shell/helper.sh

See this annotation in the file changed.

@sonarqubecloud sonarqubecloud / SonarCloud Code Analysis

Add an explicit return statement at the end of the function.

See more on https://sonarcloud.io/project/issues?id=IceWhaleTech_CasaOS&issues=AZ_ObZFJYxMmyirvnWOx&open=AZ_ObZFJYxMmyirvnWOx&pullRequest=2566

Check warning on line 335 in build/sysroot/usr/share/casaos/shell/helper.sh

See this annotation in the file changed.

@sonarqubecloud sonarqubecloud / SonarCloud Code Analysis

Function 'RestartSMBD' should be named in snake case.

See more on https://sonarcloud.io/project/issues?id=IceWhaleTech_CasaOS&issues=AZ_ObZFJYxMmyirvnWQR&open=AZ_ObZFJYxMmyirvnWQR&pullRequest=2566

Check warning on line 35 in service/file.go

See this annotation in the file changed.

@sonarqubecloud sonarqubecloud / SonarCloud Code Analysis

Remove this 'context.Context' field and pass context as a parameter to methods that need it.

See more on https://sonarcloud.io/project/issues?id=IceWhaleTech_CasaOS&issues=AZ_ObZHRYxMmyirvnWQv&open=AZ_ObZHRYxMmyirvnWQv&pullRequest=2566

Check failure on line 250 in build/sysroot/usr/share/casaos/shell/helper.sh

See this annotation in the file changed.

@sonarqubecloud sonarqubecloud / SonarCloud Code Analysis

Use '[[' instead of '[' for conditional tests. The '[[' construct is safer and more feature-rich.

See more on https://sonarcloud.io/project/issues?id=IceWhaleTech_CasaOS&issues=AZ_ObZFJYxMmyirvnWP_&open=AZ_ObZFJYxMmyirvnWP_&pullRequest=2566

Check failure on line 173 in build/sysroot/usr/share/casaos/shell/helper.sh

See this annotation in the file changed.

@sonarqubecloud sonarqubecloud / SonarCloud Code Analysis

Use '[[' instead of '[' for conditional tests. The '[[' construct is safer and more feature-rich.

See more on https://sonarcloud.io/project/issues?id=IceWhaleTech_CasaOS&issues=AZ_ObZFJYxMmyirvnWP4&open=AZ_ObZFJYxMmyirvnWP4&pullRequest=2566

Check warning on line 334 in route/v1/system.go

See this annotation in the file changed.

@sonarqubecloud sonarqubecloud / SonarCloud Code Analysis

Make sure using this hardcoded IP address is safe here.

See more on https://sonarcloud.io/project/issues?id=IceWhaleTech_CasaOS&issues=AZ_ObZDQYxMmyirvnWOs&open=AZ_ObZDQYxMmyirvnWOs&pullRequest=2566

Check warning on line 65 in build/sysroot/usr/share/casaos/shell/helper.sh

See this annotation in the file changed.

@sonarqubecloud sonarqubecloud / SonarCloud Code Analysis

Add an explicit return statement at the end of the function.

See more on https://sonarcloud.io/project/issues?id=IceWhaleTech_CasaOS&issues=AZ_ObZFJYxMmyirvnWPK&open=AZ_ObZFJYxMmyirvnWPK&pullRequest=2566

Check warning on line 120 in build/sysroot/usr/share/casaos/shell/helper.sh

See this annotation in the file changed.

@sonarqubecloud sonarqubecloud / SonarCloud Code Analysis

Function 'GetPlugInDisk' should be named in snake case.

See more on https://sonarcloud.io/project/issues?id=IceWhaleTech_CasaOS&issues=AZ_ObZFJYxMmyirvnWPo&open=AZ_ObZFJYxMmyirvnWPo&pullRequest=2566

Check warning on line 90 in build/sysroot/usr/share/casaos/shell/helper.sh

See this annotation in the file changed.

@sonarqubecloud sonarqubecloud / SonarCloud Code Analysis

Assign this positional parameter to a local variable.

See more on https://sonarcloud.io/project/issues?id=IceWhaleTech_CasaOS&issues=AZ_ObZFJYxMmyirvnWPc&open=AZ_ObZFJYxMmyirvnWPc&pullRequest=2566

Check warning on line 340 in build/sysroot/usr/share/casaos/shell/helper.sh

See this annotation in the file changed.

@sonarqubecloud sonarqubecloud / SonarCloud Code Analysis

Add an explicit return statement at the end of the function.

See more on https://sonarcloud.io/project/issues?id=IceWhaleTech_CasaOS&issues=AZ_ObZFJYxMmyirvnWQU&open=AZ_ObZFJYxMmyirvnWQU&pullRequest=2566

Check warning on line 79 in build/sysroot/usr/share/casaos/shell/helper.sh

See this annotation in the file changed.

@sonarqubecloud sonarqubecloud / SonarCloud Code Analysis

Assign this positional parameter to a local variable.

See more on https://sonarcloud.io/project/issues?id=IceWhaleTech_CasaOS&issues=AZ_ObZFJYxMmyirvnWPX&open=AZ_ObZFJYxMmyirvnWPX&pullRequest=2566

Check failure on line 107 in route/v1/file.go

See this annotation in the file changed.

@sonarqubecloud sonarqubecloud / SonarCloud Code Analysis

Define a constant instead of duplicating this literal "invalid file path" 13 times.

See more on https://sonarcloud.io/project/issues?id=IceWhaleTech_CasaOS&issues=AZ_ObY8YYxMmyirvnWOq&open=AZ_ObY8YYxMmyirvnWOq&pullRequest=2566

Check warning on line 51 in route/v1/other.go

See this annotation in the file changed.

@sonarqubecloud sonarqubecloud / SonarCloud Code Analysis

Make sure using this hardcoded IP address is safe here.

See more on https://sonarcloud.io/project/issues?id=IceWhaleTech_CasaOS&issues=AZ_ObZDsYxMmyirvnWOt&open=AZ_ObZDsYxMmyirvnWOt&pullRequest=2566