fix(security): address CodeQL high-severity alerts

- SSH host keys: replace AutoAddPolicy with WarningPolicy in
  connections.py and polling.py (#2, OmniDB#60)
- Path traversal in plugins.py: use realpath + containment check
  in load_plugin, and os.path.basename() for uploaded filenames
  in handle_uploaded_file (#4-OmniDB#18)
- PostgreSQL.py MD5: add noqa suppression — this is PostgreSQL's
  own md5 auth format (md5+password+role), not our own hashing (OmniDB#19)
- tests.yml: add permissions: contents: read to all three jobs
  (OmniDB#61, OmniDB#62, OmniDB#63)
- Socket binding false positive: already uses 127.0.0.1 (OmniDB#59)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: heptau

.github/workflows/tests.yml

@@ -9,6 +9,8 @@ on:
 jobs:
   test:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
       - uses: actions/checkout@v4
@@ -36,6 +38,8 @@ jobs:
 
   lint:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
       - uses: actions/checkout@v4
@@ -54,6 +58,8 @@ jobs:
 
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
       - uses: actions/checkout@v4

OmniDB/OmniDB_app/include/OmniDatabase/PostgreSQL.py

@@ -13439,7 +13439,7 @@ def ChangeRolePassword(self, p_role, p_password):
 			'''.format(
 				p_role,
 				'md5{0}'.format(
-					hashlib.md5(p_password.encode('utf-8') + p_role.encode('utf-8')).hexdigest()
+					hashlib.md5(p_password.encode('utf-8') + p_role.encode('utf-8')).hexdigest()  # noqa: S324 — PostgreSQL md5 auth protocol format
 				)
 			)
 		)

OmniDB/OmniDB_app/views/connections.py

@@ -276,7 +276,7 @@ def test_connection(request):
 
 		client = paramiko.SSHClient()
 		client.load_system_host_keys()
-		client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
+		client.set_missing_host_key_policy(paramiko.WarningPolicy())
 
 		v_key_file = None
 		try:

OmniDB/OmniDB_app/views/plugins.py

@@ -45,7 +45,10 @@ def load_plugin(plugin_folder, p_load):
 	if plugin_folder[0]=='.':
 		return
 
-	complete_plugin_folder = join(settings.HOME_DIR,'plugins',plugin_folder)
+	plugins_root = os.path.realpath(join(settings.HOME_DIR, 'plugins'))
+	complete_plugin_folder = os.path.realpath(join(plugins_root, plugin_folder))
+	if not complete_plugin_folder.startswith(plugins_root + os.sep):
+		return
 
 	if isfile(join(complete_plugin_folder,'backend','plugin.conf')):
 		conf_exists = True
@@ -355,7 +358,8 @@ def handle_uploaded_file(f):
 
 	makedirs(v_dir_name)
 
-	v_file = join(v_dir_name,f.name)
+	safe_filename = os.path.basename(f.name)
+	v_file = join(v_dir_name, safe_filename)
 
 	with open(v_file, 'wb+') as destination:
 		for chunk in f.chunks():
@@ -373,6 +377,8 @@ def handle_uploaded_file(f):
 	v_plugin_folder_name = ''
 	plugin_dir_name = ''
 
+	safe_plugin_name = os.path.basename(os.path.splitext(safe_filename)[0])
+
 	# Old format
 	if v_has_plugins_folder:
 
@@ -383,7 +389,7 @@ def handle_uploaded_file(f):
 				'v_message': '''Package doesn't have the static/plugins directory.'''
 			}
 		else:
-			plugin_dir_name = os.path.splitext(f.name)[0]
+			plugin_dir_name = safe_plugin_name
 			v_plugin_folder_name = plugin_dir_name
 			makedirs(join(settings.HOME_DIR,'plugins',plugin_dir_name))
 
@@ -444,7 +450,7 @@ def handle_uploaded_file(f):
 				'v_message': '''Package doesn't have the frontend directory.'''
 			}
 		else:
-			plugin_dir_name = os.path.splitext(f.name)[0]
+			plugin_dir_name = safe_plugin_name
 			makedirs(join(settings.HOME_DIR,'plugins',plugin_dir_name))
 			try:
 				files = listdir(join(v_dir_name,'backend'))

OmniDB/OmniDB_app/views/polling.py

@@ -278,7 +278,7 @@ def callback(self):
 
 					client = paramiko.SSHClient()
 					client.load_system_host_keys()
-					client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
+					client.set_missing_host_key_policy(paramiko.WarningPolicy())
 
 					#ssh key provided
 					if v_conn_object['tunnel']['key'].strip() != '':