fix(security): resolve dependency vulns and fix container exec tenant isolation#54
Merged
fix(security): resolve dependency vulns and fix container exec tenant isolation#54
Conversation
… isolation Dependency updates: - Bump tar 0.4 → 0.4.45 (RUSTSEC-2026-0067, RUSTSEC-2026-0068: symlink follow + PAX header) - Update aws-lc-rs → 1.16.2 / aws-lc-sys → 0.39.1 (RUSTSEC-2026-0044: X.509 bypass) - Update rustls-webpki → 0.103.10 (RUSTSEC-2026-0049: CRL matching) - Update rkyv → 0.7.46 (RUSTSEC-2026-0001: undefined behavior on OOM) - Update rustls → 0.23.37 Code fixes: - container_exec: validate container belongs to project/environment before exec, preventing cross-tenant container access (HIGH severity) - FilesystemStorage: add path traversal protection to resolve_path(), rejecting keys with ".." components (MEDIUM severity) Remaining unfixable vulns documented in Cargo.toml comments.
The track_open and track_click handlers are public routes (no auth) mounted via configure_public_routes(), which doesn't have the middleware that injects RequestMetadata. This caused a 500 error: "Missing request extension: RequestMetadata was not found". Fix: accept RequestMetadata as Option<Extension<RequestMetadata>> and fall back to extracting IP/UA from headers directly.
Add tracked_html_body column to emails table to store the final HTML sent to the provider (with tracking pixel + rewritten links), separate from the original html_body. This lets the dashboard show the tracked version without triggering a fake open event from the preview pixel. - Migration: add nullable tracked_html_body text column - Entity: add tracked_html_body field - EmailService: store tracked_html in new column during send - API: expose tracked_html_body in email list/detail responses
The email_events table may have been created before link_url and link_index columns were added to the CREATE TABLE statement. This migration adds them with IF NOT EXISTS to fix tracking failures: "column link_url does not exist".
Add a "Link Clicks" section to the tracking card that fetches
/emails/{id}/tracking/links and shows each tracked link with its
click count badge. Links with clicks get a default badge, unclicked
links get a secondary badge.
The tracking service was using a hardcoded TEMPS_BASE_URL env var (defaulting to localhost:3000), which meant tracking pixels and click links in emails pointed to localhost — unreachable from Gmail's image proxy or any external email client. Now uses ConfigService.get_external_url_or_default() to dynamically resolve the external URL from the database settings, matching how other subsystems (error tracking, deployments) already work.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
tarto 0.4.45,aws-lc-systo 0.39.1,rustls-webpkito 0.103.10,rkyvto 0.7.46, andrustlsto 0.23.37 — resolving 6 CVEs (1 high, 4 medium, 1 low)exec_commandandcontainer_terminalhandlers now validate that the container belongs to the specified project/environment before allowing exec, preventing cross-tenant container accessFilesystemStorage::resolve_pathnow rejects storage keys containing..componentsVulnerability Resolution
..rejection in resolve_pathTest plan
cargo check --libpassescargo test --lib -p temps-log-aggregator— 98 tests pass