jramos/cve-dashboard
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix Archer Jira ticket description auto-population and security audit fixes

Browse Source 
Auto-populate description field when creating Jira tickets from the Archer
page with ticket metadata (EXC number, CVE, vendor, status, Archer URL).
Previously the description was always empty, requiring manual entry.

Includes security audit fixes for SQL injection prevention and input
validation in compliance, VCL multi-vertical, and CCP metrics routes.

Updates security audit tracker documentation.
This commit is contained in:
Jordan Ramos
2026-06-05 09:53:53 -06:00
parent e8aa7038ad
commit af5fa11421
6 changed files with 133 additions and 114 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
backend/routes/vclMultiVertical.js
View File

@@ -280,7 +280,7 @@ function createVCLMultiVerticalRouter(upload) {
total_items: xlsxData.total || xlsxData.items.length,
summary_entries: (xlsxData.summary && xlsxData.summary.entries) ? xlsxData.summary.entries.length : 0,
diff: { new_count: diff.newCount, recurring_count: diff.recurringCount, resolved_count: diff.resolvedCount },
tempFile: tempFilePath,
tempFile: tempFilename,
});
} catch (parseErr) {
unrecognized.push({ filename: file.originalname, error: parseErr.message });
@@ -334,12 +334,15 @@ function createVCLMultiVerticalRouter(upload) {
// Validate all temp files exist before starting transaction
for (const file of files) {
if (!file.tempFile || !isSafeTempPath(file.tempFile)) {
const resolvedPath = path.join(TEMP_DIR, path.basename(file.tempFile || ''));
if (!file.tempFile || !isSafeTempPath(resolvedPath)) {
return res.status(400).json({ error: `Invalid tempFile path for ${file.vertical || 'unknown'}` });
}
if (!fs.existsSync(file.tempFile)) {
if (!fs.existsSync(resolvedPath)) {
return res.status(400).json({ error: `Preview session expired for ${file.vertical || 'unknown'} — please upload again` });
}
// Store resolved path for use in the transaction
file._resolvedTempFile = resolvedPath;
}
const client = await pool.connect();
@@ -349,7 +352,7 @@ function createVCLMultiVerticalRouter(upload) {
const committed = [];
for (const file of files) {
let parsed;
try { parsed = JSON.parse(fs.readFileSync(file.tempFile, 'utf8')); }
try { parsed = JSON.parse(fs.readFileSync(file._resolvedTempFile, 'utf8')); }
catch { throw new Error(`Could not read preview data for ${file.vertical}`); }
const result = await persistMultiVerticalUpload({
@@ -374,7 +377,7 @@ function createVCLMultiVerticalRouter(upload) {
// Clean up temp files
for (const file of files) {
fs.unlink(file.tempFile, () => {});
fs.unlink(file._resolvedTempFile, () => {});
}
// Audit log
@@ -401,7 +404,7 @@ function createVCLMultiVerticalRouter(upload) {
await client.query('ROLLBACK');
// Clean up temp files on failure too
for (const file of files) {
if (file.tempFile) fs.unlink(file.tempFile, () => {});
if (file._resolvedTempFile) fs.unlink(file._resolvedTempFile, () => {});
}
console.error('[VCL Multi] Commit error:', err.message);
res.status(500).json({ error: 'Failed to commit batch: ' + err.message });