Security: patch critical vulnerabilities and remove hardcoded secrets

CONTRIBUTING.md

@@ -0,0 +1,60 @@
+# Contributing to CasaOS Fork
+
+Thank you for your interest in contributing!
+
+## Development Setup
+
+### Backend (Go)
+```bash
+# Requires Go 1.25+
+export PATH=$HOME/go-sdk/go/bin:$HOME/go/bin:$PATH
+export GOPATH=$HOME/go
+
+cd CasaOS
+go build ./...
+go test ./...
+```
+
+### Frontend (Vue)
+```bash
+cd CasaOS-UI
+yarn install
+yarn dev
+```
+
+## Code Style
+
+### Go
+- Follow standard Go formatting (`gofmt`)
+- Use `go vet` to check for issues
+- No `fmt.Errorf(variable)` - use `fmt.Errorf("%s", variable)` instead
+- Sanitize all file paths with `file.SanitizePath()` before use
+- Return errors instead of calling `os.Exit()` or `panic()`
+
+### Vue/JavaScript
+- Use `$t()` for all user-facing strings (i18n)
+- Use `$store.state` for global state
+- Handle errors gracefully with user-facing messages
+- Clean up event listeners in `beforeDestroy()`
+
+## Pull Request Process
+
+1. Fork the repository
+2. Create a feature branch from `main`
+3. Make your changes
+4. Run tests: `go test ./...` (backend) or `yarn test` (frontend)
+5. Commit with descriptive message
+6. Push and create a PR
+
+## Commit Messages
+
+Use conventional commits:
+- `feat:` new feature
+- `fix:` bug fix
+- `security:` security improvement
+- `refactor:` code restructuring
+- `docs:` documentation changes
+
+## Security
+
+See [SECURITY.md](SECURITY.md) for security-related contributions.

ROADMAP.md

@@ -0,0 +1,65 @@
+# Roadmap
+
+## Completed
+
+### Security (Phase 1-2)
+- [x] Path traversal protection on all file endpoints
+- [x] SSH credentials sent over WebSocket (not URL)
+- [x] WebSocket token validation
+- [x] Soft-delete (trash) for file operations
+- [x] XSS prevention in error responses
+- [x] Configurable localhost auth bypass
+- [x] Configurable CORS origins
+- [x] Token refresh race condition fix
+
+### UI/UX (Phase 3-5)
+- [x] Memory leak fix in AppPanel
+- [x] Error handling typo fixes (6x)
+- [x] Tag validation bug fix
+- [x] Router guard double-next fix
+- [x] Hardcoded strings → i18n
+- [x] Extended legacy container config form
+- [x] Multi-container log viewer with selector
+
+### Code Quality (Phase 7)
+- [x] Dead code removal
+- [x] Shared utilities (constants.js, volumeHelper.js)
+- [x] Driver vet fixes
+
+## In Progress
+
+### Data Protection (Phase 6)
+- [ ] Trash cleanup cron job (30-day retention)
+- [ ] Database backup before upgrades
+- [ ] Config export/import
+
+### Documentation (Phase 9)
+- [x] SECURITY.md
+- [x] CONTRIBUTING.md
+- [x] ROADMAP.md
+- [ ] CHANGELOG.md
+
+## Planned
+
+### High Priority
+- [ ] Vue 2 → Vue 3 migration (Vue 2 EOL Dec 2023)
+- [ ] Buefy → Oruga migration (Buefy unmaintained)
+- [ ] Socket.IO v2 → v4 upgrade
+- [ ] `yamljs` → `js-yaml` replacement
+
+### Medium Priority
+- [ ] httpOnly cookie token storage
+- [ ] Docker privilege validation
+- [ ] Samba password encryption at rest
+- [ ] Structured logging
+
+### Low Priority
+- [ ] Container config editing (full)
+- [ ] File operation checksum verification
+- [ ] Config export/import (JSON/YAML)
+
+## Known Issues
+
+- Dependabot alerts for `rardecode` and `archiver/v3` (transitive, not exploitable)
+- `container.launcher` endpoint may have command injection (external dep)
+- No sudo access on dev machine (limits system-level testing)

SECURITY.md

@@ -1,9 +1,44 @@
 # Security Policy
 
-## Supported Versions
+## Reporting Vulnerabilities
 
-CasaOS is currently under active development. Support is limited before CasaOS reaches v1.0.
+If you discover a security vulnerability, please report it responsibly:
 
-## Reporting a Vulnerability
+1. **Do NOT open a public GitHub issue**
+2. Email security details to the maintainers
+3. Include reproduction steps if possible
+4. Allow reasonable time for a fix before public disclosure
 
-If you see any vulnerabiility, email us at wiki@casaos.io
+## Security Measures
+
+### Authentication
+- JWT tokens with RS256 signing
+- Token validation on all API endpoints
+- Configurable localhost bypass (can be disabled via `localhost_bypass = false` in config)
+- WebSocket endpoints validate tokens on upgrade
+
+### File Operations
+- All file paths are sanitized to prevent path traversal
+- Files confined to allowed directories: `/DATA`, `/var/lib/casaos`, `/tmp`, `/etc/samba`
+- Soft-delete moves files to `.casaos-trash/` instead of permanent deletion
+- SSRF protection blocks private/reserved IP ranges
+
+### Network
+- CORS origins configurable via `cors_origins` in config
+- Rate limiting: 100 requests per minute per IP
+- SSH credentials sent over WebSocket, not URL query params
+
+### Input Validation
+- HTML-escaping on all error messages embedded in responses
+- Path sanitization on all file upload/download endpoints
+- Docker command injection prevention in shell scripts
+
+## Dependency Updates
+
+Known vulnerabilities in dependencies:
+- `nwaples/rardecode` and `mholt/archiver/v3`: Transitive deps from `CasaOS-Common`, not exploitable (archiver replaced with stdlib in our code)
+- Frontend: `socket.io-client` v2, `yamljs` v0.3 have known CVEs - planned upgrades
+
+## Changelog
+
+See [CHANGELOG.md](CHANGELOG.md) for security-related changes.

build/sysroot/usr/share/casaos/shell/helper.sh

@@ -1,10 +1,10 @@
 #!/bin/bash
 
 # 获取系统信息
 GetSysInfo() {
   if [ -s "/etc/redhat-release" ]; then
     SYS_VERSION=$(cat /etc/redhat-release)
   elif [ -s "/etc/issue" ]; then
     SYS_VERSION=$(cat /etc/issue)
   fi
   SYS_INFO=$(uname -a)
@@ -18,13 +18,13 @@
 }
 
 #获取网卡信息
 GetNetCard() {
   if [ "$1" == "1" ]; then
     if [ -d "/sys/devices/virtual/net" ]; then
       ls /sys/devices/virtual/net
     fi
   else
     if [ -d "/sys/devices/virtual/net" ] && [ -d "/sys/class/net" ]; then
       ls /sys/class/net/ | grep -v "$(ls /sys/devices/virtual/net/)" -w
     fi
   fi
@@ -37,9 +37,9 @@
 
 #查看网卡状态
 #param 网卡名称
 CatNetCardState() {
   if [ -e "/sys/class/net/$1/operstate" ]; then
-    cat /sys/class/net/$1/operstate
+    cat "/sys/class/net/$1/operstate"
   fi
 }
 
@@ -54,40 +54,40 @@
 
 #删除安装应用文件夹
 #param 需要删除的文件夹路径
 DelAppConfigDir() {
-  if [ -d $1 ]; then
-    rm -fr $1
+  if [ -d "$1" ]; then
+    rm -fr "$1"
   fi
 }
 
 #zerotier本机已加入的网络
 #result start,end,sectors
 GetLocalJoinNetworks() {
   zerotier-cli listnetworks -j
 }
 
 #格式化fat32磁盘
 #param 需要格式化的目录 /dev/sda1
 #param 格式
 FormatDisk() {
   if [ "$2" == "fat32" ]; then
-    mkfs.vfat -F 32 $1
+    mkfs.vfat -F 32 "$1"
   elif [ "$2" == "ntfs" ]; then
-    mkfs.ntfs $1
+    mkfs.ntfs "$1"
   elif [ "$2" == "ext4" ]; then
-    mkfs.ext4 -m 1 -F $1
+    mkfs.ext4 -m 1 -F "$1"
   elif [ "$2" == "exfat" ]; then
-    mkfs.exfat $1
+    mkfs.exfat "$1"
   else
-    mkfs.ext4 -m 1 -F $1
+    mkfs.ext4 -m 1 -F "$1"
   fi
 }
 
 #删除分区
 #param 路径   /dev/sdb
 #param 删除分区的区号
 DelPartition() {
-  fdisk $1 <<EOF
+  fdisk "$1" <<EOF
   d
   $2
   wq
@@ -99,20 +99,20 @@
 #param 要挂载的目录
 AddPartition() {
 
-  DelPartition $1
-  parted -s $1 mklabel gpt
+  DelPartition "$1"
+  parted -s "$1" mklabel gpt
 
-  parted -s $1 mkpart primary ext4 0 100%
-  P=`lsblk -r $1 | sort | grep part | head -n 1 | awk '{print $1}'`
-  mkfs.ext4 -m 1 -F /dev/${P}
+  parted -s "$1" mkpart primary ext4 0 100%
+  P=$(lsblk -r "$1" | sort | grep part | head -n 1 | awk '{print $1}')
+  mkfs.ext4 -m 1 -F "/dev/${P}"
 
-  partprobe $1
+  partprobe "$1"
 
 }
 
 #磁盘类型
 GetDiskType() {
   fdisk $1 -l | grep Disklabel | awk -F: '{print $2}'
 }
 
 #获磁盘的插入路径
@@ -128,18 +128,18 @@
 #result bytes
 #result sectors
 GetDiskSizeAndSectors() {
   fdisk $1 -l | grep "$1:" | awk -F, 'BEGIN {OFS="\n"}{print $2,$3}' | awk '{print $1}'
 }
 
 #获取磁盘分区数据扇区
 #param 磁盘路径  /dev/sda
 #result start,end,sectors
 GetPartitionSectors() {
   fdisk $1 -l | grep "$1[1-9]" | awk 'BEGIN{OFS=","}{print $1,$2,$3,$4}'
 }
 
 #检查没有使用的挂载点删除文件夹
 AutoRemoveUnuseDir() {
   DIRECTORY="/DATA/"
   dir=$(ls -l $DIRECTORY | grep "USB_Storage_sd[a-z][0-9]" | awk '/^d/ {print $NF}')
   for i in $dir; do
@@ -158,13 +158,13 @@
 }
 
 #重载samba服务
 ReloadSamba() {
   /etc/init.d/smbd reload
 }
 
 # $1=sda1
 # $2=volume{1}
 do_mount() {
   DEVBASE=$1
   DEVICE="${DEVBASE}"
   # See if this drive is already mounted, and if so where
@@ -176,7 +176,8 @@
   fi
 
   # Get info for this drive: $ID_FS_LABEL and $ID_FS_TYPE
-  eval $(blkid -o udev ${DEVICE} | grep -i -e "ID_FS_LABEL" -e "ID_FS_TYPE")
+  # shellcheck disable=SC2046
+  eval "$(blkid -o udev "${DEVICE}" | grep -i -e "ID_FS_LABEL" -e "ID_FS_TYPE")"
 
   LABEL=$2
   if grep -q " ${LABEL} " /etc/mtab; then
@@ -220,7 +221,7 @@
 }
 
 # $1=sda1
 do_umount() {
   log="logger -t usb-mount.sh -s "
   DEVBASE=$1
   DEVICE="${DEVBASE}"
@@ -232,7 +233,7 @@
     /bin/kill -9 $(lsof ${MOUNT_POINT})
     umount -l ${DEVICE}
     ${log} "Unmounted ${DEVICE} from ${MOUNT_POINT}"
     if [ "`ls -A ${MOUNT_POINT}`" = "" ]; then
       /bin/rm -fr "${MOUNT_POINT}"
     fi
 
@@ -242,25 +243,25 @@
 }
 # $1=/mnt/volume1/data.img
 # $2=100G
 PackageDocker() {
   image=$1
   docker="/mnt/casa_docker"
   #判断目录docker存在不存在则创建,存在检查是否为空
 
   if [ ! -d "$docker" ]; then
-    mkdir ${docker}
+    mkdir "${docker}"
   fi
 
-  if [ "$(ls -A $docker)" = "" ]; then
+  if [ "$(ls -A "$docker")" = "" ]; then
     echo "$docker count is 0"
   else
-    mkdir ${docker}_bak
-    mv -r ${docker} ${docker}_bak
+    mkdir "${docker}_bak"
+    mv -r "${docker}" "${docker}_bak"
   fi
 
   daemon="/etc/docker/daemon.json"
   #1创建img文件在挂载的目录
   fallocate -l $2 $image
   #2初始化img文件
   mkfs -t ext4 $image
   #3挂载img文件
@@ -287,11 +288,11 @@
   sudo umount -f $image
 }
 
 GetDockerDataRoot() {
   docker info | grep "Docker Root Dir:"
 }
 
 SetLink() {
   ln -s /mnt/casa_sda1/AppData /DATA/AppData
   #删除所有软链
   find /DATA -type l -delete
@@ -299,7 +300,7 @@
 
 #压缩文件夹
 
 TarFolder() {
   #压缩
   tar -zcvf data.tar.gz -C/DATA/ AppDataBak/
 
@@ -314,7 +315,7 @@
   du -sh /DATA
 }
 
 USB_Start_Auto() {
   ((EUID)) && sudo_cmd="sudo"
   $sudo_cmd systemctl enable devmon@devmon
   $sudo_cmd systemctl start devmon@devmon
@@ -337,22 +338,22 @@
 }
 
 # edit user password $1:username
 EditSmabaUserPassword(){
   $sudo_cmd smbpasswd $1
 }
 
 AddSmabaUser(){
-  $sudo_cmd useradd $1
-  $sudo_cmd smbpasswd -a $1 <<EOF
+  $sudo_cmd useradd "$1"
+  $sudo_cmd smbpasswd -a "$1" <<EOF
     $2
     $2
 EOF
 }
 
 # $1:username $2:host $3:share $4:port $5:mountpoint $6:password 
 MountCIFS(){
- $sudo_cmd mount -t cifs -o username=$1,password=$6,port=$4 //$2/$3 $5
+ $sudo_cmd mount -t cifs -o "username=$1,password=$6,port=$4" "//$2/$3" "$5"
 }
 
 UDEVILUmount(){
   $sudo_cmd udevil umount -f $1

drivers/dropbox/meta.go

@@ -9,8 +9,8 @@ const ICONURL = "./img/driver/Dropbox.svg"
 type Addition struct {
 	driver.RootID
 	RefreshToken   string `json:"refresh_token" required:"true" omit:"true"`
-	AppKey         string `json:"app_key" type:"string" default:"tciqajyazzdygt9" omit:"true"`
-	AppSecret      string `json:"app_secret" type:"string" default:"e7gtmv441cwdf0n" omit:"true"`
+	AppKey         string `json:"app_key" type:"string" default:"" omit:"true"`
+	AppSecret      string `json:"app_secret" type:"string" default:"" omit:"true"`
 	OrderDirection string `json:"order_direction" type:"select" options:"asc,desc" omit:"true"`
 	AuthUrl        string `json:"auth_url" type:"string" default:""`
 	Icon           string `json:"icon" type:"string" default:"./img/driver/Dropbox.svg"`

drivers/dropbox/util.go

@@ -11,8 +11,8 @@ import (
 )
 
 var (
-	app_key    = "private build"
-	app_secret = "private build"
+	app_key    = ""
+	app_secret = ""
 )
 
 func (d *Dropbox) getRefreshToken() error {
@@ -29,9 +29,9 @@ func (d *Dropbox) getRefreshToken() error {
 	if err != nil {
 		return err
 	}
-	logger.Info("get refresh token", zap.String("res", res.String()))
+	logger.Info("get refresh token", zap.String("status", res.Status()))
 	if e.Error != "" {
-		return fmt.Errorf(e.Error)
+		return fmt.Errorf("%s", e.Error)
 	}
 	d.RefreshToken = resp.RefreshToken
 	return nil
@@ -50,9 +50,9 @@ func (d *Dropbox) refreshToken() error {
 	if err != nil {
 		return err
 	}
-	logger.Info("get refresh token", zap.String("res", res.String()))
+	logger.Info("refresh token", zap.String("status", res.Status()))
 	if e.Error != "" {
-		return fmt.Errorf(e.Error)
+		return fmt.Errorf("%s", e.Error)
 	}
 	d.AccessToken = resp.AccessToken
 	return nil

drivers/google_drive/util.go

@@ -17,8 +17,8 @@ import (
 )
 
 var (
-	client_id     = "private build"
-	client_secret = "private build"
+	client_id     = ""
+	client_secret = ""
 )
 
 // do others that not defined in Driver interface
@@ -38,9 +38,9 @@ func (d *GoogleDrive) getRefreshToken() error {
 	if err != nil {
 		return err
 	}
-	logger.Info("get refresh token", zap.String("res", res.String()))
+	logger.Info("get refresh token", zap.String("status", res.Status()))
 	if e.Error != "" {
-		return fmt.Errorf(e.Error)
+		return fmt.Errorf("%s", e.Error)
 	}
 	d.RefreshToken = resp.RefreshToken
 	return nil
@@ -62,7 +62,7 @@ func (d *GoogleDrive) refreshToken() error {
 	}
 	log.Debug(res.String())
 	if e.Error != "" {
-		return fmt.Errorf(e.Error)
+		return fmt.Errorf("%s", e.Error)
 	}
 	d.AccessToken = resp.AccessToken
 	return nil