Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Validate the timeout setting #1303

Open
AlexRuiz7 opened this issue Apr 18, 2022 · 0 comments
Open

Validate the timeout setting #1303

AlexRuiz7 opened this issue Apr 18, 2022 · 0 comments
Assignees
Labels
type/bug Bug issue

Comments

@AlexRuiz7
Copy link
Member

Wazuh Splunk Rev
4.3 8.1.4 4301

Description
It's required to ensure that the timeout setting is on a valid state, this is, strictly greater than zero at least.

It's possible to set a zero or even negative value, which might set the application on an unuseful state. Fortunately, this is not happening as the Requests library already takes care of validating that no invalid timeout is used, but we need no enforce these checks on our side too, for a better UX and reliability.

This setting can be set either on the WUI, on the Configuration section, or directly on the configuration file, at /default/config.conf

In order to harden the App, this (and preferably every setting) must be validated on the frontend and on the backend.

  • Frontend: no value lower than 1 can be set.
  • Backend: if a value lower than zero is read, use a predefined value instead (i.e: 20 seconds)

Steps to reproduce

  1. Go to Settings > Configuration
  2. Edit the timeout setting.
  3. Observe that any value can be set, even negatives.

Screenshots
image

@AlexRuiz7 AlexRuiz7 added the type/bug Bug issue label Apr 18, 2022
@vikman90 vikman90 added this to the Release 4.4.0 milestone Aug 31, 2022
@gdiazlo gdiazlo removed this from the Release 4.4.0 milestone Sep 5, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
type/bug Bug issue
Projects
None yet
Development

No branches or pull requests

3 participants