J1-PIPELINE: EdgeGateway audit, security hardening, and documentation fixes - #5
Open
OneByJorah wants to merge 9 commits into
Open
J1-PIPELINE: EdgeGateway audit, security hardening, and documentation fixes#5OneByJorah wants to merge 9 commits into
OneByJorah wants to merge 9 commits into
Conversation
added 9 commits
July 5, 2026 20:35
The README documented the dashboard on port 8080, but the actual code defaults to port 5000 (DASHBOARD_PORT=5000 in 01_install.sh and dashboard.py). This mismatch would confuse users trying to access the dashboard after installation.
The renderLeases() function used innerHTML with template literals to render DHCP lease data, including untrusted hostnames from dnsmasq leases. A malicious DHCP client could set a crafted hostname to inject JavaScript. Fixed by using DOM API (textContent) instead of innerHTML, which automatically escapes all HTML entities.
The dashboard's AP subnet check used a fragile prefix match (client_ip.startswith()) that only worked for /24 subnets. A /16 or /28 configuration would silently bypass the restriction. Replaced with Python's ipaddress module for proper CIDR notation support. Now any valid subnet (e.g., 10.0.0.0/8, 172.16.0.0/16, 192.168.1.0/28) is correctly validated.
…and installer - Added Requirements section to README documenting root access, Cloudflare WARP, WiFi AP chipset, and Telegram Bot Token needs - Added prominent default password warning in both README and 01_install.sh output - Resolves EGW-001 (missing requirements documentation)
The iptables rules flushed existing rules but did not set a default DROP policy on INPUT and FORWARD chains, leaving the system with an implicit ACCEPT policy for any traffic not explicitly matched. Added explicit DROP defaults for INPUT and FORWARD chains, with ACCEPT for OUTPUT. This ensures only explicitly allowed traffic (loopback, established connections, AP→WARP forwarding) is permitted.
- Created requirements.txt with version-pinned Python dependencies (flask, flask-socketio, python-telegram-bot==20.8, psutil, requests, gunicorn, eventlet) - Updated 01_install.sh to install from requirements.txt instead of inline pip install - Added reports/ to .gitignore
- Update git remote URL to OneByJorah/WarpGate - Update README: title, clone URL, project structure - Update INTENT.md: all references (repo name, paths, descriptions) - Update 01_install.sh: /etc/WarpGate, /opt/WarpGate paths - Update 02_configure.sh: /etc/WarpGate, /opt/WarpGate paths - Update j1.yaml: repo name - Update requirements.txt: header comment - Update deploy_log.txt: header
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
J1-PIPELINE Phase 14 (PUBLISHER) — Push all pending EdgeGateway changes from the audit, security hardening, and documentation pipeline.
Changes in this PR
Plus 6 pre-existing security and documentation commits already on this branch:
Checklist
publish/20260705Pipeline
OneByJorah/EdgeGateway