Repository navigation
Conversation
This issue is technically on FXServer's args parsing, but patching in txAdmin as well. Also renamed the method param name for clarity.
commit 22f3284313f3dccae932b69b8ad2df15bf7692b4
Author: tabarra <1808295+tabarra@users.noreply.github.com>
Date: Sat Feb 7 08:44:29 2026 -0300
wip: bunch of minor misc changes
commit 504e7540a77d105cc1dc390bd6f7bb8608fe67b8
Author: tabarra <1808295+tabarra@users.noreply.github.com>
Date: Sat Feb 7 06:17:37 2026 -0300
wip: fixed core test suite
commit a6ed99134ed6369583cd43c275fc3006070e6ff3
Author: tabarra <1808295+tabarra@users.noreply.github.com>
Date: Thu Feb 5 13:16:07 2026 -0300
wip: replaced resource name everywhere (hopefully)
commit f3f7efcc14ac4d9d70f1e24683a816fbda509059
Author: tabarra <1808295+tabarra@users.noreply.github.com>
Date: Thu Feb 5 12:45:45 2026 -0300
wip: fixed package lock
commit 07c76b1b0266dcc6a4a36bb84a5ada22a8bc4c3a
Author: tabarra <1808295+tabarra@users.noreply.github.com>
Date: Thu Feb 5 11:30:22 2026 -0300
wip: running on standalone runtime
commit 110ee1fa4e4c8d7c4c6799e21666ba9f1ed271c8
Author: tabarra <1808295+tabarra@users.noreply.github.com>
Date: Tue Feb 3 17:55:41 2026 -0300
wip: injecting txadmin version via esbuild
commit ab143563fa5fdf6fabdb00caac89343a039397fe
Author: tabarra <1808295+tabarra@users.noreply.github.com>
Date: Sun Feb 1 19:02:50 2026 -0300
wip: started removing all convars
commit 70b3a45edc43b52582c9375f3d1e4a30687ecb46
Author: tabarra <1808295+tabarra@users.noreply.github.com>
Date: Sun Feb 1 18:09:06 2026 -0300
wip: removed support for txAdminZapConfig.json
commit dcccc03a83bd199cbc2a67e99c994e1ae0c2f19a
Author: tabarra <1808295+tabarra@users.noreply.github.com>
Date: Sat Jan 31 19:45:45 2026 -0300
wip: replaced password hashing natives with bcryptjs library
commit 46fae16d81aec901d90e1f30ae9218b0af5fa47e
Author: tabarra <1808295+tabarra@users.noreply.github.com>
Date: Tue Jan 27 11:07:35 2026 -0300
ci: install zip package for build process
commit 88cca43cf4b9ec5ef8334fe4ed7dfa6fd2ecca18
Author: tabarra <1808295+tabarra@users.noreply.github.com>
Date: Tue Jan 27 11:02:41 2026 -0300
ci: update workflow to inject a GITHUB_REF
commit caa4db4a7c41273793a8bd4c0965c08a1e23c102
Author: tabarra <1808295+tabarra@users.noreply.github.com>
Date: Tue Jan 27 10:42:49 2026 -0300
ci: add GitLab CI for experimental builds
commit 6e2ee66cbdd442b5aa79b6b3cb731575ffb27176
Author: tabarra <1808295+tabarra@users.noreply.github.com>
Date: Fri Jan 23 18:43:38 2026 -0300
wip: improved convar resolution
commit 195687c8812af550b7571495a588e93cbe706194
Author: tabarra <1808295+tabarra@users.noreply.github.com>
Date: Wed Jan 21 10:25:17 2026 -0300
wip: created external natives file
commit c2cb2fc260120e8cdeaa29dcd9b22c7e0ba76b11
Author: tabarra <1808295+tabarra@users.noreply.github.com>
Date: Wed Jan 21 10:13:41 2026 -0300
wip: patched resource name in lua files
commit 2aa40ac055eb05715d07fcf976123203604c7f5f
Author: tabarra <1808295+tabarra@users.noreply.github.com>
Date: Wed Jan 21 10:12:38 2026 -0300
wip: package fixes
The session cookie's Secure attribute was hardcoded to false regardless of deployment, so an admin session could be replayed over plain HTTP even behind a TLS-terminating reverse proxy. Koa's own app.proxy trust stays disabled (ctx.ip/ctx.protocol keep using the raw socket everywhere else), so this reads X-Forwarded-Proto directly, scoped to just this cookie's Secure flag.
…ord.js Patches known advisories on the locked versions (host header injection and XSS in koa, code injection and prototype pollution in lodash, auth plugin downgrade in mysql2, merge-key DoS in js-yaml, command injection in systeminformation). None of these were reachable through txAdmin's own call sites as far as I could verify, but the locked versions were sitting on vulnerable releases. discord.js is bumped past its exact pin to 14.27.0 (non-major) to pull in the @discordjs/rest, @discordjs/ws and undici fixes transitively. nanoid and stream-json also have advisories but only through a major bump (5.x and 3.7.0), and the vulnerable functions in both aren't called anywhere in this codebase, so left alone here to keep this patch non-breaking.
Collaborator
|
I agree with the main change idea, but this PR is messy, and also includes a bunch of dep bumps which I do not want. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Secure(sessionMws.ts): hardcodedsecure: falseregardless of deployment, so the admin session cookie could be replayed over plain HTTP even behind a TLS reverse proxy. Now readsX-Forwarded-Protodirectly (not viaapp.proxy, which stays off elsewhere) just for this cookie's flag. AddedisForwardedHttps()+ test.koa,lodash,mysql2,js-yaml,systeminformationin-range, anddiscord.js14.11.0 → 14.27.0 (non-major) for the@discordjs/rest/ws/undicifixes. None of these looked reachable through this codebase's actual call sites, but the locked versions were vulnerable regardless. Leftnanoid/stream-jsonalone (major-only fix, also unreachable here).Didn't touch the other things I found (ban-check linear scan on every join, full-file rewrite of
playersDB.jsonper save) - real, but architectural, not a small diff.Testing
npm run typecheckclean.npm run test --workspaces: 255 passing (202 core incl. 5 new, 53 panel).