vyos-documentation.git/docs, branch claude/vyos-docs-security-remediate-2cff61

security: normalize percent escapes per run, not per segment

2026-07-28T02:36:57+00:00

Round-2 adversarial finding (Codex, medium): whole-segment decode meant one malformed escape (a%20b%zz) threw for the segment and double-encoded the valid escapes beside it. encodeSegment now decodes+re-encodes each well-formed %HH run independently; literal spans (including a bare '%') always pass through encodeURIComponent, so taint neutralization holds unconditionally; a run decoding to invalid UTF-8 stays verbatim (already pure %HH text). workers suite 108/108 (+2 discriminating regression tests). 🤖 Generated by [robots](https://vyos.io)

security: normalize pre-existing percent escapes in encodePath

2026-07-28T02:24:34+00:00

Adversarial-review finding (Codex, medium): location.pathname returns well-formed escapes verbatim, so blind encodeURIComponent double-encoded them (%2E -> %252E), broke the HEAD probe on escaped deep links, and dumped the user at the version root. Each segment is now decoded first (malformed escapes keep the raw segment — no throw), then re-encoded to canonical single encoding. Decoding cannot resurrect dot-segments: the URL parser resolves '.'/'..' and their percent-encoded forms during navigation, so pathname never presents them (verified against the WHATWG parser in Node). workers suite 106/106 (+2 regression tests, mutation-verified). 🤖 Generated by [robots](https://vyos.io)

security: remediate CodeQL code-scanning alerts (picker XSS sinks, test sanitization, vendored DataTables exclusion)

2026-07-28T01:29:23+00:00

Remediates all 11 open CodeQL alerts on the default branch: - version-picker.js (js/xss-through-dom, alerts 1-3): percent-encode every DOM-derived path component (select.value, parsed location segments) at URL construction time via encodePath()/langUrlFor(), and tighten the parseLocation slug charset to [A-Za-z0-9._-]. No-op on legitimate sphinx slugs — URLs stay byte-identical (asserted by tests). - workers/apex/test/manifest.test.ts (js/incomplete-multi-character- sanitization, alert 6): strip HTML comments from the root.html fixture repeatedly to a fixpoint instead of a single pass. - docs/_static/js/datatables.js (alerts 4,5,7-11): excluded from CodeQL analysis via .github/codeql/codeql-config.yml (new codeql-cfg-path input to the fleet reusable workflow). The file is vendored stock DataTables 1.11.5; the flagged helpers are display/sort normalization, not sanitization boundaries. Excluding keeps the vendored copy byte-identical to upstream instead of hand-patching it. Adds 9 picker tests (hostile-input encoding + slug-charset accept/reject); workers suite 103/103 green. 🤖 Generated by [robots](https://vyos.io)

docs: exclude superpowers/ from the Sphinx build

2026-07-28T00:13:48+00:00

`docs/superpowers/` holds Claude Code plugin-generated internal design specs and plans, not user documentation. Adding `superpowers` to `exclude_patterns` guards against Sphinx ever picking the directory up and publishing it should it reappear in the source tree. Guard only — the content itself was already removed in 3ab97e71 and abb8be5b.

Merge pull request #2152 from BradKollmyer/vyos-api-doc-gaps-T9087-T9092

2026-07-21T12:41:44+00:00

vyos-api: fill automation API doc gaps (T9087–T9092)

docs: Update Event handler page to VyOS 1.5 standards (#2130)

2026-07-20T09:52:42+00:00

* docs: Update Event handler page to VyOS 1.5 standards * Apply suggestions from code review Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

docs: update flowtable and ethernet/bonding documentation (#2106)

2026-07-20T09:38:55+00:00

* docs: update flowtable and ethernet/bonding documentation * Removing Netfilter word and add the identification of the interfaces to use FlowTables * Fixed warning from commit:c433e15 * Update docs/configuration/firewall/flowtables.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Update docs/configuration/firewall/flowtables.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Update docs/configuration/firewall/flowtables.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Update docs/configuration/firewall/flowtables.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * cfgmc structure and sub-interface offload fixed * Fixed conflicts on flowtable documentation * revert ethernet.md and fixed the latest infos * added subsection to the checks section to show offloaded traffic for sub-interfaces * Final changes * Changed conntrack -L to VyOS command * Replacing new output description with VyOS command --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

vyos-api: T9087: T9092: apply review feedback (line length, retry safety)

2026-07-14T21:08:40+00:00

Convert the multi-field-node table to wrapped list items per the 80-char docs guideline, and rework the bulk-apply bullet to reconcile state before retrying after a timeout instead of recommending blind retries. Co-Authored-By: Claude Fable 5

vyos-api: T9087: tighten firewall same-request wording (review feedback)

2026-07-14T21:00:18+00:00

Only port/port-group require protocol in the same request; description alone is fine on an existing rule but fails on a rule no request has created yet. Co-Authored-By: Claude Fable 5

vyos-api: T9092: add bulk configuration guidance

2026-07-14T20:50:41+00:00

Batch sizing, geoip/remote-group commit cost, the 1 MB request-body-size-limit, and commit-confirm as a remote safety net. Co-Authored-By: Claude Fable 5