01184664d2
Merge remote-tracking branch 'origin/fix/cves' into fix/cves-master
7 months ago
9dcb6d53bf
Update lombok from 1.18.38 to 1.18.44 managed by Spring Boot 3.5.12
7 months ago
caffeb7ce8
Update jedis from 5.1.5 to 6.0.0 and snakeyaml from 2.2 to 2.4 for Spring Boot 3.5.12 compatibility
7 months ago
7646f79cfe
Implement addBundleRegisterHandler for Spring Boot 3.5 SslBundles compatibility
7 months ago
0eabe6ce46
Fix CVE-2026-22731, CVE-2026-22732, CVE-2026-22733, CVE-2026-22737
7 months ago
d232862f63
Merge pull request #15265 from mtsymbarov-del/feat/input-new-style
Moved inputs to outlined styles
7 months ago
e7075db0a5
Merge pull request #15269 from thingsboard/master-rc-merge
Merge rc into master
7 months ago
3ca7f37c70
Merge remote-tracking branch 'origin/rc' into master-rc-merge
# Conflicts:
# rule-engine/rule-engine-components/src/test/java/org/thingsboard/rule/engine/rest/TbHttpClientTest.java
7 months ago
2ed9ed2ff5
Merge remote-tracking branch 'origin/lts-4.3' into rc
7 months ago
59873373cc
Merge remote-tracking branch 'origin/lts-4.2' into lts-4.3
7 months ago
95d2e77c82
UI: Fixed yarn.lock
7 months ago
c2ff92772e
Merge pull request #15266 from thingsboard/fix-csp-example
Set default value for Content-Security-Policy
7 months ago
fd86a860da
Merge pull request #14618 from MazurenkoNick/refactor-edge-session
Refactor Edge related classes: session, service, server
7 months ago
02529029c5
Update default CSP value covering core ThingsBoard functionality
7 months ago
628fe04032
Make SsrfProtectionValidator-dependent tests more stable
7 months ago
a425e35e60
Missed input
7 months ago
de0c2850f7
Fix CSP example value to include img-src and font-src directives
7 months ago
061b997457
Fixed resetting of validation on storeLink property
7 months ago
132b683cd4
Merge pull request #15242 from wbg1991/feature/korean-localization
Update Korean locale translations
7 months ago
ffde28eeb5
Remove redurant multiple locale entries from Korean JSON
7 months ago
3f7833f225
Merge pull request #14540 from dskarzh/fix/rest-api-node/url-encoding
Fixed query parameter encoding in REST API call rule node
7 months ago
c944858859
Merge branch 'master' into feat/input-new-style
7 months ago
511d709b03
Remove stale todo in PostgresBasedEdgeGrpcSessionManager
7 months ago
0b3e736c0e
Merge pull request #15263 from thingsboard/rc
Merge rc into master
7 months ago
a69e5f0132
Merge remote-tracking branch 'origin/lts-4.3' into rc
7 months ago
b984cf16c9
Merge remote-tracking branch 'origin/lts-4.2' into lts-4.3
# Conflicts:
# application/src/main/java/org/thingsboard/server/exception/ThingsboardErrorResponseHandler.java
7 months ago
1baf16cf41
Merge branch 'master' into refactor-edge-session
7 months ago
4e32c6490a
Restore interrupt flag in awaitConsumerTermination
7 months ago
5f93a5a0a2
Merge pull request #15262 from thingsboard/fix/verbose-error-messages
Sanitize database error messages
7 months ago
2647b807f6
Remove shadowing downlinkMessageMapper field in KafkaBasedEdgeGrpcSessionManager
7 months ago
d915dbeb03
Fix potential NPE on getState() in PostgresBasedEdgeGrpcSessionManager
7 months ago
dc7b86fa1d
Address PR review comments for edge session refactoring
- Deduplicate forEach iteration over both session maps (HashSet)
- Use null-safe getEdgeId() instead of getEdge().getId() in remove()
- Add defensive null checks on getState() in onConfigurationUpdate and destroyAndMarkAsZombieIfFailed
- Add null check on pendingMsgsMap.get() in onDownlinkResponse
- Move scheduleAtFixedRate to @PostConstruct in DefaultZombieSessionCleanupService
- Fix misleading "kafka sessions" log message to "zombie sessions"
- Chain IOException in GrpcServer RuntimeException
- Guard against race condition on removeByEdgeId in onEdgeDisconnect
- Rename shadowed parameter in shutdownExecutorSafely
7 months ago
688a1d52b3
Sanitize database error messages
Route DataAccessException and PersistenceException (including bare
ConstraintViolationException) to a unified handler that extracts the
constraint name and returns "Constraint violation: <name>" instead of
the raw PSQLException message. Other DB errors continue to return the
generic "Database error" response.
Adds DaoUtil.extractConstraintViolation helper and an integration test
that verifies no SQL details leak when an FK constraint is violated.
7 months ago
934d742cc6
Fix missing translation for Polylines toggle in map settings
Replace hardcoded "Polylines" text with existing i18n key
widgets.maps.overlays.polylines to match other overlay toggles.
Fixes #15234
7 months ago
fc2d3f559c
Merge pull request #15239 from dashevchenko/openApiSchemaOrdering
Fixed openapi schema ordering
7 months ago
4d5d61664a
Merge pull request #15257 from thingsboard/master-rc-merge
Merge rc to master
7 months ago
6f2d90655a
Merge remote-tracking branch 'origin/rc' into master-rc-merge
7 months ago
a8ac27f17b
Merge remote-tracking branch 'origin/lts-4.3' into rc
7 months ago
c057da1734
Merge remote-tracking branch 'origin/lts-4.2' into lts-4.3
# Conflicts:
# application/src/main/java/org/thingsboard/server/config/ThingsboardSecurityConfiguration.java
7 months ago
4f7e232ee7
Merge pull request #15251 from vvlladd28/fix/vulnerability/16-03-26
Fixed CVE-2026-24281, CVE-2026-24308, CVE-2026-24400, CVE-2026-29063, CVE-2026-29087, CVE-2026-29786, CVE-2026-30827, CVE-2026-31802, CVE-2026-32141, CVE-2026-32635, CVE-2026-27904
7 months ago
2a3ac2972b
Merge pull request #15219 from vvlladd28/fix/ws-reconnect-backoff-rate-limit
Fixed WS reconnect loop and notification spam when session limit is reached
7 months ago
5f56345722
Merge pull request #15253 from thingsboard/fix/ssrf
Fixed SSRF DNS rebinding bypass, added allow-list
7 months ago
d83a28beaa
Optimize SsrfSafeAddressResolverGroup, remove dead isEnabled checks
Replace stream().filter().collect() in resolveAll with single-pass loop
to avoid allocations on the common path (nothing blocked). Remove
redundant isEnabled() checks inside the resolver since it is only wired
when SSRF protection is enabled. Add resolveAll test coverage.
7 months ago
959a1a84a4
Make SSRF resolver conditional, sanitize error messages, improve test coverage
Wire SsrfSafeAddressResolverGroup only when SSRF protection is enabled.
Remove "SSRF protection" prefix from error messages to avoid exposing
internal security mechanisms to users. Add 11 new tests covering
isHostnameAllowed, one-arg validateUri, allow-list case-insensitivity,
cloud metadata/loopback overrides, CIDR boundaries, IPv6 unique local,
whitespace parsing, allow-list replacement, and blocked hostname override.
7 months ago
3747553527
Improve SSRF validator test coverage
Add tests for: isHostnameAllowed API, one-arg validateUri overload,
allow-list case-insensitivity, allow-list overriding cloud metadata and
loopback ranges, CIDR boundary conditions, IPv6 unique local (fc00::/7),
whitespace/blank entry parsing, allow-list replacement, and allow-listing
blocked hostnames like localhost.
7 months ago
5d7bfe4ee1
Merge pull request #15254 from thingsboard/fix/cors
Added configurable security headers and env-var-backed CORS configuration
7 months ago
61bccb005a
Restore runtime SSRF validation in CustomOAuth2ClientMapper
Keep both save-time validation (Oauth2ClientDataValidator) and runtime
re-validation as defense-in-depth: DNS records can change between config
save and OAuth2 login, creating a TOCTOU gap.
7 months ago
c09c821411
Fix EdgeGrpcSslTest
7 months ago
014c612bf1
Fix boolean/string comparison for env var overrides in web-ui security headers
7 months ago
493140f1b2
Remove dead else branch in web-ui security headers config
7 months ago
Viacheslav Klimov
Vladyslav Prykhodko
Maksym Tsymbarov
Nikita Mazurenko
Mazurenko Nikita