csaf_ndaal:ndaal-sa-2026-1107

{
  "$schema": "https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json",
  "document": {
    "category": "csaf_base",
    "csaf_version": "2.1",
    "distribution": {
      "tlp": {
        "label": "CLEAR"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Release announcement for ndaal SARIF Viewer (sarif-viewer) 1.2.19. The release adds an Upload menu that sends a SARIF file from the browser (POST /upload, guarded by an Origin / Sec-Fetch-Site check and a 64 MiB body cap) and reads request bodies over HTTP/3 as well. This is an informational release note, not a vulnerability disclosure: it carries no security impact and is scored CVSS 0.0 (NONE) for both CVSS v3.1 and CVSS v4.0."
      },
      {
        "category": "description",
        "text": "sarif-viewer 1.2.19 adds an Upload tab (GET and POST /upload). The file is validated against its SARIF schema and admitted through the same path as Import; a file that is not SARIF is refused with 422, a malformed body with 400, a cross-site request with 403 and a body over 64 MiB with 413. The router gained POST routes, and the HTTP/3 request loop, which used to discard request bodies, now reads them under the same cap. The release also adds property tests, a model test of the log store and four fuzz targets for the upload path, and repairs two fuzz targets that had stopped compiling. No security defect is fixed in this release; the previous release (1.2.18) fixed the language-switcher open redirect, ndaal-sa-2026-1104."
      },
      {
        "category": "details",
        "text": "Reused from CHANGELOG.md (v1.2.19): (1) [Added] **Upload menu.** A new **Upload** tab, right after Dashboard as in the ndaal sbom-auditor, sends a SARIF file from the browser (`GET`/`POST /upload`, multipart). The file is validated against its SARIF schema and admitted through the same path as Import (`import::admit_bytes`); success redirects `303` to the new log, a file that is not SARIF is `422`, a malformed body is `400`, a cross-site request is `403`. The multipart parser (`src/upload.rs`), the `same_origin` CSRF gate and the capped body reader are ported from sbom-auditor with their tests. The page is translated in English, German and French; other languages show the English text until translated. (2) [Added] **POST routes in the router.** `RouterBuilder::post`, body handlers that receive the request body as bytes, an `Allow` header that lists the methods registered for the path, and a 64 MiB body cap (`413`) shared by HTTP/1.1, HTTP/2 and HTTP/3. The HTTP/3 request loop used to discard request bodies; it now reads them, and a test with a real QUIC client covers it. `POST /upload` is the first write route that checks `Origin` / `Sec-Fetch-Site`; the three `GET` actions in arc42 risk R-3 still do not. (3) [Added] **Tests for the upload path.** The router and `same_origin` unit tests; `tests/test_upload.rs` (11 cases); `tests/test_upload_h3.rs` (a real QUIC client); ten property tests in `tests/proptest_upload.rs` (the CSRF gate, verbatim multipart content, a safe basename for any client file name, an exact 413 boundary, 405 with `Allow` for any other method, and `admit_bytes` never overwriting a log); a `proptest-state-machine` model test of `SarifStore` (`tests/proptest_state_machine_store.rs`); the Bruno `upload/` folder and `pages/07-upload-page.bru`; the Playwright `upload.spec.ts`. Injected bugs in the gate, the body cap and the file-name sanitiser each fail them. (4) [Added] **Fuzz targets** `fuzz_multipart_parse`, `fuzz_same_origin`, `fuzz_upload_request` and `fuzz_return_path`. New dev-dependency `proptest-state-machine` 0.9; `memchr` 2.8 is now a direct dependency for the multipart boundary search (already in the tree, so no new crate). (5) [Fixed] **Two fuzz targets that no longer compiled.** `fuzz_html_render` and `fuzz_report_html` had been broken since the language work added a `Lang` parameter to `html::page` and `report_html`; `cargo fuzz run <target>` builds only the target named, so it went unnoticed. Both are repaired, now fuzz across all 46 languages and assert the translated verdict. (6) [Fixed] The six `#[tokio::test]` router tests are skipped under Miri, which cannot emulate the `kqueue` call tokio's I/O driver makes on macOS. (7) [Changed] **Main menu order.** The navbar now reads Dashboard, Upload, Import, Export, Validate: Upload sits right after Dashboard, and Validate moved from before Export to right after it. Pinned by a unit test (`main_tabs_are_ordered_dashboard_upload_import_export_validate`), a Bruno test (`pages/06-main-menu-order.bru`) and a Playwright test (`navigation.spec.ts`, English and German). The User Guide names the order. (8) [Changed] Import and Upload share one admission path, `import::admit_bytes`."
      },
      {
        "category": "general",
        "text": "Recommended action: upgrade to sarif-viewer 1.2.19 to use the Upload menu. No security action is required. Operators tracking the ndaal advisory feed may ingest this document as the canonical record of the sarif-viewer 1.2.19 release. Prebuilt binaries for Linux, Windows and macOS (x86_64 and aarch64) are attached to the GitLab release, and the crate is published on crates.io (cargo binstall sarif-viewer). The full change list is published in CHANGELOG.md in the repository."
      },
      {
        "category": "other",
        "text": "CVSS applicability: this is a release announcement and carries no security impact itself, scored CVSS v3.1 0.0 (NONE) and CVSS v4.0 0.0 (NONE) with all impact metrics set to NONE. The score is intentionally zero to signal 'informational, no vulnerability' while still carrying a machine-readable metric; the release fixes no vulnerability. Status: final."
      },
      {
        "category": "legal_disclaimer",
        "text": "THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY. ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS INFORMATION INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS."
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "security@ndaal.eu",
      "issuing_authority": "ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG Security Team",
      "name": "ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG",
      "namespace": "https://ndaal.eu/csaf"
    },
    "references": [
      {
        "category": "self",
        "summary": "This advisory in CSAF 2.1 format",
        "url": "https://gitlab.com/vPierre/ndaal_public_nvulnlookup/-/raw/main/csaf/2026/1107/ndaal-sa-2026-1107.json"
      },
      {
        "category": "external",
        "summary": "CHANGELOG 1.2.19",
        "url": "https://gitlab.com/vPierre/ndaal_public_sarif_viewer/-/raw/main/CHANGELOG.md"
      },
      {
        "category": "external",
        "summary": "GitLab release v1.2.19 with prebuilt binaries and checksums",
        "url": "https://gitlab.com/vPierre/ndaal_public_sarif_viewer/-/releases/v1.2.19"
      },
      {
        "category": "external",
        "summary": "sarif-viewer 1.2.19 on crates.io",
        "url": "https://crates.io/crates/sarif-viewer/1.2.19"
      },
      {
        "category": "external",
        "summary": "ndaal_public_sarif_viewer repository",
        "url": "https://gitlab.com/vPierre/ndaal_public_sarif_viewer"
      },
      {
        "category": "external",
        "summary": "ndaal-sa-2026-1104: open redirect in the language switcher (CWE-601)",
        "url": "https://gitlab.com/vPierre/ndaal_public_nvulnlookup/-/raw/main/csaf/2026/1104/ndaal-sa-2026-1104.json"
      },
      {
        "category": "external",
        "summary": "CSAF 2.1 specification (OASIS)",
        "url": "https://docs.oasis-open.org/csaf/csaf/v2.1/csaf-v2.1.html"
      },
      {
        "category": "external",
        "summary": "CVSS v4.0 specification (FIRST)",
        "url": "https://www.first.org/cvss/v4-0/specification-document"
      }
    ],
    "title": "ndaal SARIF Viewer (sarif-viewer) 1.2.19 — release announcement (informational, no security impact, CVSS 0.0)",
    "tracking": {
      "current_release_date": "2026-10-26T17:29:21.000Z",
      "generator": {
        "engine": {
          "name": "ndaal CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ndaal-sa-2026-1107",
      "initial_release_date": "2026-10-26T17:29:21.000Z",
      "revision_history": [
        {
          "date": "2026-10-26T17:29:21.000Z",
          "number": "1.0.0",
          "summary": "Initial release announcement for sarif-viewer 1.2.19. Informational, no security impact, CVSS v3.1 0.0 / v4.0 0.0 (NONE). Status: final."
        }
      ],
      "status": "final",
      "version": "1.0.0"
    },
    "x_extensions": [
      {
        "$schema": "https://ndaal.eu/.well-known/csaf/extensions/dashboard-branding_1.0.0.json",
        "category": "informational",
        "content": {
          "dashboard_short_name": "ndaal",
          "publisher_brand": "ndaal Advisories Database"
        },
        "critical": false
      }
    ]
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "1.2.19",
                "product": {
                  "name": "ndaal SARIF Viewer (sarif-viewer) 1.2.19 — release announcement, no security impact.",
                  "product_id": "CSAFPID-0001",
                  "product_identification_helper": {
                    "purls": [
                      "pkg:cargo/sarif-viewer@1.2.19"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "sarif-viewer"
          }
        ],
        "category": "vendor",
        "name": "ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG"
      }
    ]
  },
  "vulnerabilities": [
    {
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "CSAFPID-0001"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "ndaal Advisory ID",
          "text": "ndaal-sa-2026-1107"
        }
      ],
      "metrics": [
        {
          "content": {
            "cvss_v3": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 0.0,
              "baseSeverity": "NONE",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
              "version": "3.1"
            },
            "cvss_v4": {
              "attackComplexity": "LOW",
              "attackRequirements": "NONE",
              "attackVector": "NETWORK",
              "baseScore": 0.0,
              "baseSeverity": "NONE",
              "privilegesRequired": "NONE",
              "subAvailabilityImpact": "NONE",
              "subConfidentialityImpact": "NONE",
              "subIntegrityImpact": "NONE",
              "userInteraction": "NONE",
              "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N",
              "version": "4.0",
              "vulnAvailabilityImpact": "NONE",
              "vulnConfidentialityImpact": "NONE",
              "vulnIntegrityImpact": "NONE"
            }
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Release announcement for sarif-viewer 1.2.19. This announcement carries a CVSS 0.0 (NONE) score so the release is represented with a machine-readable, zero-impact metric in the CSAF feed. The release fixes no vulnerability; it adds a POST route, which is guarded by an Origin / Sec-Fetch-Site check."
        },
        {
          "category": "details",
          "text": "Highlights: an Upload menu (POST /upload, 64 MiB body cap, 403 for a cross-site request); POST routes and a body cap in the router for HTTP/1.1, HTTP/2 and HTTP/3; property tests, a store model test and four fuzz targets for the upload path; two repaired fuzz targets. CHANGELOG.md has the full list."
        }
      ],
      "product_status": {
        "known_not_affected": [
          "CSAFPID-0001"
        ]
      },
      "threats": [
        {
          "category": "impact",
          "details": "None. Informational release announcement with no security impact (CVSS v3.1 0.0 / v4.0 0.0, NONE).",
          "product_ids": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "sarif-viewer 1.2.19 release — informational, no security impact (CVSS 0.0)"
    }
  ]
}