Richard/PolyTraderSharp
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Security F3+F4: verwundbares Newtonsoft ersetzt + hardcodierte Secrets entfernt

Browse Source 
F4: Newtonsoft.Json in der Threema-Lib von 11.0.2 (Advisory NU1903, high) auf 13.0.4
    gehoben (= App-Version). Build ohne NU1903, 311 Tests gruen.
F3: hardcodierte Secrets aus ServerSettings-Defaults entfernt (Alchemy-API-Key in
    PolygonRpcUrl, Mullvad-Account-ID) -> leere Defaults; echte Werte kommen aus
    server_settings.xml (gitignored). WICHTIG (nicht im Code moeglich): beide Secrets
    ROTIEREN, da sie in der Git-History liegen.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Richard
2026-07-14 16:48:29 +02:00
co-authored by Claude Opus 4.8
parent faf66102f9
commit 1a3359e874
2 changed files with 6 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libs/Threema-MsgApi-Net-Core/IcgSoftware.Threema.CoreMsgApi/IcgSoftware.Threema.CoreMsgApi.csproj
+2 -1
View File
@@ -15,7 +15,8 @@
<PackageReference Include="Microsoft.Extensions.Configuration.FileExtensions" Version="2.1.1" /> <PackageReference Include="Microsoft.Extensions.Configuration.FileExtensions" Version="2.1.1" />
<PackageReference Include="Microsoft.Extensions.Configuration.Json" Version="2.1.1" /> <PackageReference Include="Microsoft.Extensions.Configuration.Json" Version="2.1.1" />
<PackageReference Include="Microsoft.Win32.Registry" Version="4.5.0" /> <PackageReference Include="Microsoft.Win32.Registry" Version="4.5.0" />
<PackageReference Include="Newtonsoft.Json" Version="11.0.2" /> <!-- F4 (Sicherheit): von 11.0.2 (Advisory NU1903, high) auf 13.0.4 gehoben, = App-Version. -->
<PackageReference Include="Newtonsoft.Json" Version="13.0.4" />
<PackageReference Include="Sodium.Core" Version="1.2.0" /> <PackageReference Include="Sodium.Core" Version="1.2.0" />
</ItemGroup> </ItemGroup>
src/PolyTrader.Core/Models/ServerSettings.cs
+4 -4
View File
@@ -49,8 +49,8 @@ namespace PolyTraderSharp.Models
[Category("Mullvad VPN")] [Category("Mullvad VPN")]
[DisplayName("Mullvad Account")] [DisplayName("Mullvad Account")]
[Description("Account ID for Mullvad VPN.")] [Description("Account ID for Mullvad VPN. In server_settings.xml (gitignored) hinterlegen – NICHT im Code committen.")]
public string MullvadAccount { get; set; } = "7748925650632296"; public string MullvadAccount { get; set; } = ""; // F3: Secret nicht mehr im Quellcode
[Category("Mullvad VPN")] [Category("Mullvad VPN")]
[DisplayName("VPN Location")] [DisplayName("VPN Location")]
@@ -70,8 +70,8 @@ namespace PolyTraderSharp.Models
[Category("Blockchain Listener")] [Category("Blockchain Listener")]
[DisplayName("Polygon RPC URL")] [DisplayName("Polygon RPC URL")]
[Description("RPC URL for Alchemy WSS.")] [Description("RPC-/WSS-URL inkl. Alchemy-API-Key. In server_settings.xml (gitignored) hinterlegen – der Key gehört NICHT in den Quellcode/Git. Format: wss://polygon-mainnet.g.alchemy.com/v2/<KEY>")]
public string PolygonRpcUrl { get; set; } = "wss://polygon-mainnet.g.alchemy.com/v2/iWCbs9p3nf-8OpR-BtvGi"; public string PolygonRpcUrl { get; set; } = ""; // F3: Alchemy-Key nicht mehr im Quellcode
[Category("Polymarket WebSockets")] [Category("Polymarket WebSockets")]
[DisplayName("Use Polymarket WebSockets")] [DisplayName("Use Polymarket WebSockets")]