Close access control and input handling holes, test against tmc-langs by nygrenh · Pull Request #608 · testmycode/tmc-server

nygrenh · 2026-11-10T11:29:08Z

No description provided.

gitguardian · 2026-11-10T11:29:32Z

⚠️ GitGuardian has uncovered 2 secrets following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secrets in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
1508640	Triggered	Generic Password	`894d2b9`	spec/lib/safe_unzipper_spec.rb	View secret
1508639	Triggered	Generic Password	`894d2b9`	spec/lib/safe_unzipper_spec.rb	View secret

🛠 Guidelines to remediate hardcoded secrets

Understand the implications of revoking this secret by investigating where it is used in your code.
Replace and store your secret safely. Learn here the best practices.
Revoke and rotate this secret.
If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

following these best practices for managing and storing secrets including API keys and other credentials
install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

houndci-bot

Some files could not be reviewed due to errors:

Unable to find gem rubocop-rails_config; is the gem installed? Gem::MissingSp...

Unable to find gem rubocop-rails_config; is the gem installed? Gem::MissingSpecError
/home/linters/.bundle/gems/rubocop-1.5.2/lib/rubocop/config_loader_resolver.rb:237:in `rescue in gem_config_path'
/home/linters/.bundle/gems/rubocop-1.5.2/lib/rubocop/config_loader_resolver.rb:227:in `gem_config_path'
/home/linters/.bundle/gems/rubocop-1.5.2/lib/rubocop/config_loader_resolver.rb:55:in `block (2 levels) in resolve_inheritance_from_gems'
/home/linters/.bundle/gems/rubocop-1.5.2/lib/rubocop/config_loader_resolver.rb:53:in `reverse_each'
/home/linters/.bundle/gems/rubocop-1.5.2/lib/rubocop/config_loader_resolver.rb:53:in `block in resolve_inheritance_from_gems'
/home/linters/.bundle/gems/rubocop-1.5.2/lib/rubocop/config_loader_resolver.rb:46:in `each_pair'
/home/linters/.bundle/gems/rubocop-1.5.2/lib/rubocop/config_loader_resolver.rb:46:in `resolve_inheritance_from_gems'
/home/linters/.bundle/gems/rubocop-1.5.2/lib/rubocop/config_loader.rb:49:in `load_file'
/home/linters/.bundle/gems/rubocop-1.5.2/lib/rubocop/config_loader.rb:104:in `configuration_from_file'
/home/linters/.bundle/gems/rubocop-1.5.2/lib/rubocop/config_store.rb:58:in `for_dir'
/home/linters/.bundle/gems/rubocop-1.5.2/lib/rubocop/config_store.rb:37:in `for_pwd'
/home/linters/.bundle/gems/rubocop-1.5.2/lib/rubocop/cli.rb:128:in `apply_default_formatter'
/home/linters/.bundle/gems/rubocop-1.5.2/lib/rubocop/cli.rb:40:in `run'
/home/linters/.bundle/gems/rubocop-1.5.2/exe/rubocop:13:in `block in '
/usr/local/lib/ruby/2.6.0/benchmark.rb:308:in `realtime'
/home/linters/.bundle/gems/rubocop-1.5.2/exe/rubocop:12:in `'
/home/linters/.bundle/bin/rubocop:23:in `load'
/home/linters/.bundle/bin/rubocop:23:in `'
/usr/local/lib/ruby/2.6.0/bundler/cli/exec.rb:74:in `load'
/usr/local/lib/ruby/2.6.0/bundler/cli/exec.rb:74:in `kernel_load'
/usr/local/lib/ruby/2.6.0/bundler/cli/exec.rb:28:in `run'
/usr/local/lib/ruby/2.6.0/bundler/cli.rb:463:in `exec'
/usr/local/lib/ruby/2.6.0/bundler/vendor/thor/lib/thor/command.rb:27:in `run'
/usr/local/lib/ruby/2.6.0/bundler/vendor/thor/lib/thor/invocation.rb:126:in `invoke_command'
/usr/local/lib/ruby/2.6.0/bundler/vendor/thor/lib/thor.rb:387:in `dispatch'
/usr/local/lib/ruby/2.6.0/bundler/cli.rb:27:in `dispatch'
/usr/local/lib/ruby/2.6.0/bundler/vendor/thor/lib/thor/base.rb:466:in `start'
/usr/local/lib/ruby/2.6.0/bundler/cli.rb:18:in `start'
/usr/local/lib/ruby/gems/2.6.0/gems/bundler-1.17.2/exe/bundle:30:in `block in '
/usr/local/lib/ruby/2.6.0/bundler/friendly_errors.rb:124:in `with_friendly_errors'
/usr/local/lib/ruby/gems/2.6.0/gems/bundler-1.17.2/exe/bundle:22:in `'
/usr/local/bin/bundle:23:in `load'
/usr/local/bin/bundle:23:in `'

houndci-bot

Some files could not be reviewed due to errors:

Unable to find gem rubocop-rails_config; is the gem installed? Gem::MissingSp...

Unable to find gem rubocop-rails_config; is the gem installed? Gem::MissingSpecError
/home/linters/.bundle/gems/rubocop-1.5.2/lib/rubocop/config_loader_resolver.rb:237:in `rescue in gem_config_path'
/home/linters/.bundle/gems/rubocop-1.5.2/lib/rubocop/config_loader_resolver.rb:227:in `gem_config_path'
/home/linters/.bundle/gems/rubocop-1.5.2/lib/rubocop/config_loader_resolver.rb:55:in `block (2 levels) in resolve_inheritance_from_gems'
/home/linters/.bundle/gems/rubocop-1.5.2/lib/rubocop/config_loader_resolver.rb:53:in `reverse_each'
/home/linters/.bundle/gems/rubocop-1.5.2/lib/rubocop/config_loader_resolver.rb:53:in `block in resolve_inheritance_from_gems'
/home/linters/.bundle/gems/rubocop-1.5.2/lib/rubocop/config_loader_resolver.rb:46:in `each_pair'
/home/linters/.bundle/gems/rubocop-1.5.2/lib/rubocop/config_loader_resolver.rb:46:in `resolve_inheritance_from_gems'
/home/linters/.bundle/gems/rubocop-1.5.2/lib/rubocop/config_loader.rb:49:in `load_file'
/home/linters/.bundle/gems/rubocop-1.5.2/lib/rubocop/config_loader.rb:104:in `configuration_from_file'
/home/linters/.bundle/gems/rubocop-1.5.2/lib/rubocop/config_store.rb:58:in `for_dir'
/home/linters/.bundle/gems/rubocop-1.5.2/lib/rubocop/config_store.rb:37:in `for_pwd'
/home/linters/.bundle/gems/rubocop-1.5.2/lib/rubocop/cli.rb:128:in `apply_default_formatter'
/home/linters/.bundle/gems/rubocop-1.5.2/lib/rubocop/cli.rb:40:in `run'
/home/linters/.bundle/gems/rubocop-1.5.2/exe/rubocop:13:in `block in '
/usr/local/lib/ruby/2.6.0/benchmark.rb:308:in `realtime'
/home/linters/.bundle/gems/rubocop-1.5.2/exe/rubocop:12:in `'
/home/linters/.bundle/bin/rubocop:23:in `load'
/home/linters/.bundle/bin/rubocop:23:in `'
/usr/local/lib/ruby/2.6.0/bundler/cli/exec.rb:74:in `load'
/usr/local/lib/ruby/2.6.0/bundler/cli/exec.rb:74:in `kernel_load'
/usr/local/lib/ruby/2.6.0/bundler/cli/exec.rb:28:in `run'
/usr/local/lib/ruby/2.6.0/bundler/cli.rb:463:in `exec'
/usr/local/lib/ruby/2.6.0/bundler/vendor/thor/lib/thor/command.rb:27:in `run'
/usr/local/lib/ruby/2.6.0/bundler/vendor/thor/lib/thor/invocation.rb:126:in `invoke_command'
/usr/local/lib/ruby/2.6.0/bundler/vendor/thor/lib/thor.rb:387:in `dispatch'
/usr/local/lib/ruby/2.6.0/bundler/cli.rb:27:in `dispatch'
/usr/local/lib/ruby/2.6.0/bundler/vendor/thor/lib/thor/base.rb:466:in `start'
/usr/local/lib/ruby/2.6.0/bundler/cli.rb:18:in `start'
/usr/local/lib/ruby/gems/2.6.0/gems/bundler-1.17.2/exe/bundle:30:in `block in '
/usr/local/lib/ruby/2.6.0/bundler/friendly_errors.rb:124:in `with_friendly_errors'
/usr/local/lib/ruby/gems/2.6.0/gems/bundler-1.17.2/exe/bundle:22:in `'
/usr/local/bin/bundle:23:in `load'
/usr/local/bin/bundle:23:in `'

houndci-bot

Some files could not be reviewed due to errors:

Unable to find gem rubocop-rails_config; is the gem installed? Gem::MissingSp...

Unable to find gem rubocop-rails_config; is the gem installed? Gem::MissingSpecError
/home/linters/.bundle/gems/rubocop-1.5.2/lib/rubocop/config_loader_resolver.rb:237:in `rescue in gem_config_path'
/home/linters/.bundle/gems/rubocop-1.5.2/lib/rubocop/config_loader_resolver.rb:227:in `gem_config_path'
/home/linters/.bundle/gems/rubocop-1.5.2/lib/rubocop/config_loader_resolver.rb:55:in `block (2 levels) in resolve_inheritance_from_gems'
/home/linters/.bundle/gems/rubocop-1.5.2/lib/rubocop/config_loader_resolver.rb:53:in `reverse_each'
/home/linters/.bundle/gems/rubocop-1.5.2/lib/rubocop/config_loader_resolver.rb:53:in `block in resolve_inheritance_from_gems'
/home/linters/.bundle/gems/rubocop-1.5.2/lib/rubocop/config_loader_resolver.rb:46:in `each_pair'
/home/linters/.bundle/gems/rubocop-1.5.2/lib/rubocop/config_loader_resolver.rb:46:in `resolve_inheritance_from_gems'
/home/linters/.bundle/gems/rubocop-1.5.2/lib/rubocop/config_loader.rb:49:in `load_file'
/home/linters/.bundle/gems/rubocop-1.5.2/lib/rubocop/config_loader.rb:104:in `configuration_from_file'
/home/linters/.bundle/gems/rubocop-1.5.2/lib/rubocop/config_store.rb:58:in `for_dir'
/home/linters/.bundle/gems/rubocop-1.5.2/lib/rubocop/config_store.rb:37:in `for_pwd'
/home/linters/.bundle/gems/rubocop-1.5.2/lib/rubocop/cli.rb:128:in `apply_default_formatter'
/home/linters/.bundle/gems/rubocop-1.5.2/lib/rubocop/cli.rb:40:in `run'
/home/linters/.bundle/gems/rubocop-1.5.2/exe/rubocop:13:in `block in '
/usr/local/lib/ruby/2.6.0/benchmark.rb:308:in `realtime'
/home/linters/.bundle/gems/rubocop-1.5.2/exe/rubocop:12:in `'
/home/linters/.bundle/bin/rubocop:23:in `load'
/home/linters/.bundle/bin/rubocop:23:in `'
/usr/local/lib/ruby/2.6.0/bundler/cli/exec.rb:74:in `load'
/usr/local/lib/ruby/2.6.0/bundler/cli/exec.rb:74:in `kernel_load'
/usr/local/lib/ruby/2.6.0/bundler/cli/exec.rb:28:in `run'
/usr/local/lib/ruby/2.6.0/bundler/cli.rb:463:in `exec'
/usr/local/lib/ruby/2.6.0/bundler/vendor/thor/lib/thor/command.rb:27:in `run'
/usr/local/lib/ruby/2.6.0/bundler/vendor/thor/lib/thor/invocation.rb:126:in `invoke_command'
/usr/local/lib/ruby/2.6.0/bundler/vendor/thor/lib/thor.rb:387:in `dispatch'
/usr/local/lib/ruby/2.6.0/bundler/cli.rb:27:in `dispatch'
/usr/local/lib/ruby/2.6.0/bundler/vendor/thor/lib/thor/base.rb:466:in `start'
/usr/local/lib/ruby/2.6.0/bundler/cli.rb:18:in `start'
/usr/local/lib/ruby/gems/2.6.0/gems/bundler-1.17.2/exe/bundle:30:in `block in '
/usr/local/lib/ruby/2.6.0/bundler/friendly_errors.rb:124:in `with_friendly_errors'
/usr/local/lib/ruby/gems/2.6.0/gems/bundler-1.17.2/exe/bundle:22:in `'
/usr/local/bin/bundle:23:in `load'
/usr/local/bin/bundle:23:in `'

nygrenh added 5 commits November 9, 2026 10:19

Sanitize HTML preludes and drop stale Brakeman ignores

360b7ea

Lock down sandbox results, archives and submission access

894d2b9

Scope org lookups, diff views and points sheets to the caller

ea07df6

Hide exam-mode results from API points, submission lists and status

6cd7202

Check per-record read access in lists, solutions and stats

3d8d2de

nygrenh changed the title ~~Security pass~~ Close access control and input handling holes, test against tmc-langs Nov 10, 2026

houndci-bot reviewed Nov 10, 2026

View reviewed changes

nygrenh force-pushed the security-pass-2026-11 branch from a97d905 to de0f26d Compare November 10, 2026 11:34

houndci-bot reviewed Nov 10, 2026

View reviewed changes

nygrenh added 6 commits November 10, 2026 13:38

Harden OAuth tokens, password checks, throttles and CSRF

36b1d61

Harden sessions, flash, logs, CSV exports and recorded IPs

e27d2e4

Download tmc-langs safely and fix security review findings

29c60c7

Send nullable fields in forms tmc-langs can parse

988caf7

Accept tmc_cli_rust and test the client-facing APIs

86eec39

Run the vscode extension's tmc-langs build against the server

684d3b0

nygrenh force-pushed the security-pass-2026-11 branch from de0f26d to 684d3b0 Compare November 10, 2026 11:38

houndci-bot reviewed Nov 10, 2026

View reviewed changes

Navigation Menu

Repository navigation

Close access control and input handling holes, test against tmc-langs - #608

Close access control and input handling holes, test against tmc-langs#608
nygrenh wants to merge 11 commits into
masterfrom
security-pass-2026-11

nygrenh commented Nov 10, 2026

Uh oh!

gitguardian Bot commented Nov 10, 2026 •

edited

Loading

Uh oh!

houndci-bot left a comment

Uh oh!

houndci-bot left a comment

Uh oh!

houndci-bot left a comment

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

nygrenh commented Nov 10, 2026

Uh oh!

gitguardian Bot commented Nov 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ GitGuardian has uncovered 2 secrets following the scan of your pull request.

Uh oh!

houndci-bot left a comment

Choose a reason for hiding this comment

Uh oh!

houndci-bot left a comment

Choose a reason for hiding this comment

Uh oh!

houndci-bot left a comment

Choose a reason for hiding this comment

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

gitguardian Bot commented Nov 10, 2026 •

edited

Loading