dc/dc
5
1
Fork 0
Code Issues 11 Pull Requests 1 Actions Packages Projects 1 Releases 95 Wiki Activity

95 Releases 95 Tags

RSS Feed
  • v7.14.2 c69e5a80b2
    Compare

    v7.14.2 Stable

    gitea-actions released this 2026-09-22 16:17:08 +00:00 | 0 commits to main since this release

    Data Controller for SAS - v7.14.2

    Released 22 September 2026.

    This is a security release. It closes a stored XSS vector in the column-info dropdown, applies an origin check to replayed VA data-driven-content messages, and moves the access control for the public download and metadata services into the services themselves. It also changes the layout of the frontend.zip asset so that it unzips straight into your web server. There are no new features.

    Upgrade is recommended for all users.

    For installation / upgrade instructions, visit https://docs.datacontroller.io/

    Highlights

    Security hardening

    Two client-side issues and a set of service-side input-validation gaps are addressed.

    • Escaped the column-info dropdown. The dropdown HTML builder interpolated column LABEL/TYPE/LENGTH/FORMAT values and data-quality RULE_VALUE strings (HARDREGEX/SOFTREGEX/FORMULA) into an HTML string that the Viewer and Editor assigned to raw DOM innerHTML. No Angular sanitizer runs on a raw innerHTML assignment, so a user able to author a validation rule (or a column label) could store markup that executed in the browser of any editor or approver who opened that column's info dropdown. Every interpolated field is now escaped, so the values render as inert text. This is the same class of issue as the status-renderer fix in v7.14.1; this dropdown was the remaining un-escaped sink.
    • Origin-checked the replayed VA messages. DC captures SAS Visual Analytics data-driven-content messages in a pre-bootstrap listener (VA posts once, before Angular is up) and applies them on a replay path. The live path checked the message origin; the replay path did not, so a crafted DDC message could be applied from a frame the live path would have rejected. Replay now accepts a captured message only when its origin is DC's own origin or the embedding frame's origin.
    • Validated every input on the public download and metadata services. The authorisation chokepoint behind the edit/approve gate, and getrawdata, getdiffs, getcols, getcolvals and validatefilter, now validate their request inputs before any of them reach executable SAS code, using the same pattern the edit path already uses. Values are read with symget and scanned in a data step, so macro content in a request cannot execute; the getrawdata output filename is derived only from the validated table, closing a path-traversal route; and embedded quotes can no longer break out of the authorisation query's SQL literals.
    • Admin services now check admin membership in code. The admin/ folder prefix is not an access control - there is no server-side path ACL in SASjs dispatch. dirlist, refreshlibs, refreshcatalog and exportconfig now require membership of the DC administrators group in the service itself, mirroring the check exportdb already performs. dirlist also validates its parent path.

    Frontend deployment

    • frontend.zip now holds the frontend files at its root. The archive was built from ./client/dist, so every entry carried a client/dist/ prefix and unzipping left you with an extra folder to navigate into. Unzipping now gives you index.html, assets/ and the bundled viya.json directly, so the SAS 9 deployment instructions (unzip into a subfolder of the web server htdocs) work as written. Fixes #147.

    Also in this release

    • Format-catalog references are accepted by the new validation. A format catalog is addressed as LIBREF.CATALOGNAME-FC, and that form is permitted wherever a libds is validated, so catalog loads, filters, downloads and diffs behave as before.
    • New regression tests. Injection and validation tests for every service whose inputs are now validated (getrawdata, getdiffs, getcols, getcolvals, validatefilter, dirlist, refreshcatalog), a matrix test for the libds validation itself, and five DOM-injection tests for the column-info dropdown.
    • Test-infrastructure tidy-up (renamed test log marker, macro dependency declarations completed in service headers) - no product behaviour change.

    Dependencies

    No dependency changes in this release.

    Notes for administrators

    No configuration change is required on upgrade. Two points to be aware of:

    • If you relied on the admin/ folder prefix alone to protect dirlist, refreshlibs, refreshcatalog or exportconfig, those services now additionally require membership of the DC administrators group. Users outside that group will get an authorisation failure from those services.
    • The frontend.zip change only affects how you unpack the asset; the deployed files are identical.

    Full commit list: https://git.datacontroller.io/dc/dc/compare/v7.14.1...v7.14.2

    Downloads