mirror of
https://github.com/jokob-sk/NetAlertX.git
synced 2025-12-07 01:26:11 -08:00
1c2721549b
## Problem PR #1182 introduced SafeConditionBuilder to prevent SQL injection, but it only supported single-clause conditions. This broke notification filters using multiple AND/OR clauses, causing user filters like: `AND devLastIP NOT LIKE '192.168.50.%' AND devLastIP NOT LIKE '192.168.60.%'...` to be rejected with "Unsupported condition pattern" errors. ## Root Cause The `_parse_condition()` method used regex patterns that only matched single conditions. When multiple clauses were chained, the entire string failed to match any pattern and was rejected for security. ## Solution Enhanced SafeConditionBuilder with compound condition support: 1. **Added `_is_compound_condition()`** - Detects multiple logical operators while respecting quoted strings 2. **Added `_parse_compound_condition()`** - Splits compound conditions into individual clauses and parses each one 3. **Added `_split_by_logical_operators()`** - Intelligently splits on AND/OR while preserving operators in quoted strings 4. **Refactored `_parse_condition()`** - Routes to compound or single parser 5. **Created `_parse_single_condition()`** - Handles individual clauses (from original `_parse_condition` logic) ## Testing - Added comprehensive test suite (19 tests, 100% passing) - Tested user's exact failing filter (6 AND clauses with NOT LIKE) - Verified backward compatibility with single conditions - Validated security (SQL injection attempts still blocked) - Tested edge cases (mixed AND/OR, whitespace, empty conditions) ## Impact - ✅ Fixes reported issue #1210 - ✅ Maintains all security protections from PR #1182 - ✅ Backward compatible with existing single-clause filters - ✅ No breaking changes to API Fixes #1210 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
NetAlertX modules
The original pilaert.py code is now moved to this new folder and split into different modules.
| Module | Description |
|---|---|
__main__.py |
The MAIN program of NetAlertX |
__init__.py |
an empty init file |
README.md |
this readme file |
../front/plugins |
a folder containing all plugins that publish notifications or scan for devices |
api.py |
updating the API endpoints with the relevant data. |
appevent.py |
TBC |
const.py |
A place to define the constants for NetAlertX like log path or config path. |
conf.py |
conf.py holds the configuration variables and makes them available for all modules. It is also the workaround for global variables that need to be resolved at some point |
database.py |
This module connects to the DB, makes sure the DB is up to date and defines some standard queries and interfaces. |
device.py |
The device module looks after the devices and saves the scan results into the devices |
flows.py |
TBC |
helper.py |
Helper as the name suggest contains multiple little functions and methods used in many of the other modules and helps keep things clean |
initialise.py |
Initiatlise sets up the environment and makes everything ready to go |
logger.py |
Logger is there the keep all the logs organised and looking identical. |
networscan.py |
Networkscan collects the scan results (maybe to merge with reporting.py) |
notification.py |
Creates and handles the notification object and generates ther HTML and text variants of the message |
plugin.py |
This is where the plugins get integrated into the backend of NetAlertX |
plugin_utils.py |
Helper utilities for plugin.py |
reporting.py |
Reporting collects the data for the notification reports |
scheduler.py |
All things scheduling |