From ba3474f439d2df09cbbe8e73d49eba7fb74a6c87 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 05:19:49 +0000 Subject: [PATCH 01/18] fix(MESHAGEN-004-2): 27 review findings across 18 files --- modules/RecoveryCore.js | 45 ++++++++++++++++++++++++++++++++++------- 1 file changed, 38 insertions(+), 7 deletions(-) diff --git a/modules/RecoveryCore.js b/modules/RecoveryCore.js index aedef9dd8..60365600a 100644 --- a/modules/RecoveryCore.js +++ b/modules/RecoveryCore.js @@ -1,16 +1,30 @@ +/* +Copyright 2019 Intel Corporation + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ var http = require('http'); -var childProcess = require('child_process'); var meshCoreObj = { "action": "coreinfo", "value": "MeshCore Recovery", "caps": 14 }; // Capability bitmask: 1 = Desktop, 2 = Terminal, 4 = Files, 8 = Console, 16 = JavaScript var nextTunnelIndex = 1; var tunnels = {}; -var fs = require('fs'); // OpenFrame: Read machine ID from shared location var openframeMachineId = null; function getOpenFrameMachineId() { if (openframeMachineId != null) return openframeMachineId; try { + var fs = require('fs'); var machineIdPath = (process.platform == 'win32') ? (process.env['ProgramData'] + '\\OpenFrame\\machine_id') : ((process.platform == 'darwin') @@ -203,6 +217,7 @@ require('MeshAgent').AddCommandHandler(function (data) { if (tunnels[this.httprequest.index] == null) return; // Stop duplicate calls. + var fs = require('fs'); // If there is a upload or download active on this connection, close the file if (this.httprequest.uploadFile) { fs.closeSync(this.httprequest.uploadFile); this.httprequest.uploadFile = undefined; } if (this.httprequest.downloadFile) { fs.closeSync(this.httprequest.downloadFile); this.httprequest.downloadFile = undefined; } @@ -216,11 +231,12 @@ require('MeshAgent').AddCommandHandler(function (data) }); s.on('data', function (data) { + var fs = require('fs'); // If this is upload data, save it to file if (this.httprequest.uploadFile) { - try { fs.writeSync(this.httprequest.uploadFile, data); } catch (e) { this.write(new Buffer(JSON.stringify({ action: 'uploaderror' }))); return; } // Write to the file, if there is a problem, error out. - this.write(new Buffer(JSON.stringify({ action: 'uploadack', reqid: this.httprequest.uploadFileid }))); // Ask for more data + try { fs.writeSync(this.httprequest.uploadFile, data); } catch (e) { try { this.write(new Buffer(JSON.stringify({ action: 'uploaderror' }))); } catch (e) { } return; } // Write to the file, if there is a problem, error out. + try { this.write(new Buffer(JSON.stringify({ action: 'uploadack', reqid: this.httprequest.uploadFileid }))); } catch (e) { } // Ask for more data return; } @@ -246,6 +262,7 @@ require('MeshAgent').AddCommandHandler(function (data) } else { + var childProcess = require('child_process'); this.httprequest.process = childProcess.execFile("/bin/sh", ["sh"], { type: childProcess.SpawnTypes.TERM }); this.httprequest.process.tunnel = this; this.httprequest.process.on('exit', function (ecode, sig) { this.tunnel.end(); }); @@ -281,6 +298,7 @@ require('MeshAgent').AddCommandHandler(function (data) //sendConsoleText('CMD: ' + JSON.stringify(cmd)); + if ((cmd.path != null) && (cmd.path.indexOf('..') >= 0)) { return; } // Reject any path containing '..' to prevent path traversal if ((cmd.path != null) && (process.platform != 'win32') && (cmd.path[0] != '/')) { cmd.path = '/' + cmd.path; } // Add '/' to paths on non-windows //console.log(objToString(cmd, 0, ' ')); switch (cmd.action) @@ -289,10 +307,11 @@ require('MeshAgent').AddCommandHandler(function (data) // Send the folder content to the browser var response = getDirectoryInfo(cmd.path); if (cmd.reqid != undefined) { response.reqid = cmd.reqid; } - this.write(new Buffer(JSON.stringify(response))); + try { this.write(new Buffer(JSON.stringify(response))); } catch (e) { } break; case 'mkdir': { // Create a new empty folder + var fs = require('fs'); fs.mkdirSync(cmd.path); break; } @@ -300,12 +319,15 @@ require('MeshAgent').AddCommandHandler(function (data) // Delete, possibly recursive delete for (var i in cmd.delfiles) { + if ((cmd.delfiles[i] != null) && (cmd.delfiles[i].indexOf('..') >= 0)) { continue; } // Reject any name containing '..' to prevent path traversal try { deleteFolderRecursive(path.join(cmd.path, cmd.delfiles[i]), cmd.rec); } catch (e) { } } break; } case 'rename': { // Rename a file or folder + var fs = require('fs'); + if (((cmd.oldname != null) && (cmd.oldname.indexOf('..') >= 0)) || ((cmd.newname != null) && (cmd.newname.indexOf('..') >= 0))) { break; } // Reject '..' in names var oldfullpath = path.join(cmd.path, cmd.oldname); var newfullpath = path.join(cmd.path, cmd.newname); try { fs.renameSync(oldfullpath, newfullpath); } catch (e) { console.log(e); } @@ -313,17 +335,21 @@ require('MeshAgent').AddCommandHandler(function (data) } case 'upload': { // Upload a file, browser to agent + var fs = require('fs'); if (this.httprequest.uploadFile != undefined) { fs.closeSync(this.httprequest.uploadFile); this.httprequest.uploadFile = undefined; } if (cmd.path == undefined) break; + if ((cmd.name != null) && (cmd.name.indexOf('..') >= 0)) { break; } // Reject '..' in name var filepath = cmd.name ? path.join(cmd.path, cmd.name) : cmd.path; - try { this.httprequest.uploadFile = fs.openSync(filepath, 'wbN'); } catch (e) { this.write(new Buffer(JSON.stringify({ action: 'uploaderror', reqid: cmd.reqid }))); break; } + try { this.httprequest.uploadFile = fs.openSync(filepath, 'wbN'); } catch (e) { try { this.write(new Buffer(JSON.stringify({ action: 'uploaderror', reqid: cmd.reqid }))); } catch (e) { } break; } this.httprequest.uploadFileid = cmd.reqid; - if (this.httprequest.uploadFile) { this.write(new Buffer(JSON.stringify({ action: 'uploadstart', reqid: this.httprequest.uploadFileid }))); } + if (this.httprequest.uploadFile) { try { this.write(new Buffer(JSON.stringify({ action: 'uploadstart', reqid: this.httprequest.uploadFileid }))); } catch (e) { } } break; } case 'copy': { // Copy a bunch of files from scpath to dspath + var fs = require('fs'); for (var i in cmd.names) { + if ((cmd.names[i] != null) && (cmd.names[i].indexOf('..') >= 0)) { continue; } // Reject '..' in names var sc = path.join(cmd.scpath, cmd.names[i]), ds = path.join(cmd.dspath, cmd.names[i]); if (sc != ds) { try { fs.copyFileSync(sc, ds); } catch (e) { } } } @@ -331,7 +357,9 @@ require('MeshAgent').AddCommandHandler(function (data) } case 'move': { // Move a bunch of files from scpath to dspath + var fs = require('fs'); for (var i in cmd.names) { + if ((cmd.names[i] != null) && (cmd.names[i].indexOf('..') >= 0)) { continue; } // Reject '..' in names var sc = path.join(cmd.scpath, cmd.names[i]), ds = path.join(cmd.dspath, cmd.names[i]); if (sc != ds) { try { fs.copyFileSync(sc, ds); fs.unlinkSync(sc); } catch (e) { } } } @@ -449,6 +477,7 @@ function processConsoleCommand(cmd, args, rights, sessionid) // Get a formated response for a given directory path function getDirectoryInfo(reqpath) { + var fs = require('fs'); var response = { path: reqpath, dir: [] }; if (((reqpath == undefined) || (reqpath == '')) && (process.platform == 'win32')) { // List all the drives in the root, or the root itself @@ -488,6 +517,7 @@ function getDirectoryInfo(reqpath) } // Delete a directory with a files and directories within it function deleteFolderRecursive(path, rec) { + var fs = require('fs'); if (fs.existsSync(path)) { if (rec == true) { fs.readdirSync(path.join(path, '*')).forEach(function (file, index) { @@ -502,3 +532,4 @@ function deleteFolderRecursive(path, rec) { fs.unlinkSync(path); } }; + From cf8b1e8230bb07073455b22cacc97f942158e0c5 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 05:19:51 +0000 Subject: [PATCH 02/18] fix(MESHAGEN-004-2): 27 review findings across 18 files --- openframe/token_extractor.c | 37 ++++++++++++++++++++++++++++--------- 1 file changed, 28 insertions(+), 9 deletions(-) diff --git a/openframe/token_extractor.c b/openframe/token_extractor.c index 438195fe3..b9199a22c 100644 --- a/openframe/token_extractor.c +++ b/openframe/token_extractor.c @@ -1,3 +1,18 @@ +/* +Copyright 2024 Intel Corporation + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ #include #include #include @@ -12,10 +27,10 @@ #define MAX_FILE_SIZE 4096 // Function prototypes for internal functions -char* read_token_file(const char* filename, size_t* file_size); -char* decrypt_aes_gcm(const unsigned char* ciphertext, size_t ciphertext_len, +static char* OpenFrame_read_token_file(const char* filename, size_t* file_size); +static char* OpenFrame_decrypt_aes_gcm(const unsigned char* ciphertext, size_t ciphertext_len, const unsigned char* key, size_t* plaintext_len); -char* base64_decode(const char* input, size_t* output_len); +static char* OpenFrame_base64_decode(const char* input, size_t* output_len); // Main token extraction function with secret and token path parameters char* extract_token(const char* secret, const char* token_path) { @@ -27,13 +42,13 @@ char* extract_token(const char* secret, const char* token_path) { } size_t file_size; - char* file_data = read_token_file(filename, &file_size); + char* file_data = OpenFrame_read_token_file(filename, &file_size); if (!file_data) { return NULL; } size_t decoded_len; - char* encrypted_data = base64_decode(file_data, &decoded_len); + char* encrypted_data = OpenFrame_base64_decode(file_data, &decoded_len); free(file_data); if (!encrypted_data) { @@ -51,14 +66,14 @@ char* extract_token(const char* secret, const char* token_path) { size_t ciphertext_len = decoded_len; // Full decoded data for GCM decryption size_t plaintext_len; - char* decrypted_token = decrypt_aes_gcm((const unsigned char*)encrypted_data, ciphertext_len, (const unsigned char*)secret, &plaintext_len); + char* decrypted_token = OpenFrame_decrypt_aes_gcm((const unsigned char*)encrypted_data, ciphertext_len, (const unsigned char*)secret, &plaintext_len); free(encrypted_data); return decrypted_token; } // Function to read file content -char* read_token_file(const char* filename, size_t* file_size) { +static char* OpenFrame_read_token_file(const char* filename, size_t* file_size) { FILE* file = fopen(filename, "rb"); if (!file) { return NULL; @@ -97,7 +112,7 @@ char* read_token_file(const char* filename, size_t* file_size) { } // Base64 decode function -char* base64_decode(const char* input, size_t* output_len) { +static char* OpenFrame_base64_decode(const char* input, size_t* output_len) { BIO *bio, *b64; size_t input_len = strlen(input); char* buffer = malloc(input_len + 1); @@ -123,7 +138,7 @@ char* base64_decode(const char* input, size_t* output_len) { } // AES-GCM decryption function -char* decrypt_aes_gcm(const unsigned char* ciphertext, size_t ciphertext_len, +static char* OpenFrame_decrypt_aes_gcm(const unsigned char* ciphertext, size_t ciphertext_len, const unsigned char* key, size_t* plaintext_len) { const int GCM_NONCE_SIZE = 12; const int GCM_TAG_SIZE = 16; @@ -198,6 +213,7 @@ char* decrypt_aes_gcm(const unsigned char* ciphertext, size_t ciphertext_len, char err_buf[256]; ERR_error_string_n(err, err_buf, sizeof(err_buf)); printf("OpenSSL error: %s\n", err_buf); + OPENSSL_cleanse(plaintext, actual_ciphertext_len + 1); free(plaintext); EVP_CIPHER_CTX_free(ctx); return NULL; @@ -207,6 +223,7 @@ char* decrypt_aes_gcm(const unsigned char* ciphertext, size_t ciphertext_len, // Set expected tag if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_TAG, GCM_TAG_SIZE, (void*)tag) != 1) { printf("Failed to set authentication tag\n"); + OPENSSL_cleanse(plaintext, actual_ciphertext_len + 1); free(plaintext); EVP_CIPHER_CTX_free(ctx); return NULL; @@ -219,6 +236,7 @@ char* decrypt_aes_gcm(const unsigned char* ciphertext, size_t ciphertext_len, char err_buf[256]; ERR_error_string_n(err, err_buf, sizeof(err_buf)); printf("OpenSSL error: %s\n", err_buf); + OPENSSL_cleanse(plaintext, actual_ciphertext_len + 1); free(plaintext); EVP_CIPHER_CTX_free(ctx); return NULL; @@ -232,3 +250,4 @@ char* decrypt_aes_gcm(const unsigned char* ciphertext, size_t ciphertext_len, return plaintext; } + From e742d84f8658a08125e867563bf4e19d0216b718 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 05:19:53 +0000 Subject: [PATCH 03/18] fix(MESHAGEN-004-2): 27 review findings across 18 files --- meshcore/openframe_file_logger.h | 48 ++++++++++++++------------------ 1 file changed, 21 insertions(+), 27 deletions(-) diff --git a/meshcore/openframe_file_logger.h b/meshcore/openframe_file_logger.h index f13aeee99..0c82655c3 100644 --- a/meshcore/openframe_file_logger.h +++ b/meshcore/openframe_file_logger.h @@ -1,11 +1,28 @@ +/* + * Copyright (C) Intel Corporation + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + /* OpenFrame File Logger - Duplicates printf to both console and file Usage: Call enable_file_logging() at the start of main() Features: -- Single log file: meshagent.log +- Single log file: meshcentral-agent.log - Auto-rotation at 10MB -- Keeps only 1 archive (meshagent.log.old.gz) +- Keeps only 1 archive (meshcentral-agent.log.old.gz) */ #ifndef OPENFRAME_FILE_LOGGER_H @@ -39,6 +56,7 @@ Usage: Call enable_file_logging() at the start of main() #include #include #include +#include #endif /* Macro to ignore return values */ @@ -173,30 +191,6 @@ static inline long get_file_size(const char* filepath) { } static inline int compress_file_to_gzip(const char* source_path, const char* dest_path) { -#ifdef WIN32 - FILE* src = fopen(source_path, "rb"); - FILE* dst = fopen(dest_path, "wb"); - char buffer[8192]; - size_t bytes; - - if (!src || !dst) { - if (src) fclose(src); - if (dst) fclose(dst); - return 0; - } - - while ((bytes = fread(buffer, 1, sizeof(buffer), src)) > 0) { - if (fwrite(buffer, 1, bytes, dst) != bytes) { - fclose(src); - fclose(dst); - return 0; - } - } - - fclose(src); - fclose(dst); - return 1; -#else FILE* src = fopen(source_path, "rb"); gzFile dst = gzopen(dest_path, "wb9"); char buffer[8192]; @@ -219,7 +213,6 @@ static inline int compress_file_to_gzip(const char* source_path, const char* des fclose(src); gzclose(dst); return 1; -#endif } static inline int rotate_log_file(void) { @@ -708,3 +701,4 @@ static inline void disable_file_logging(void) } #endif // OPENFRAME_FILE_LOGGER_H + From 8394b80ab6fa9c3468806a83ae65f121974085db Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 05:19:55 +0000 Subject: [PATCH 04/18] fix(MESHAGEN-004-2): 27 review findings across 18 files --- modules/security-permissions.js | 46 +++++++++++++++++---------------- 1 file changed, 24 insertions(+), 22 deletions(-) diff --git a/modules/security-permissions.js b/modules/security-permissions.js index 9dd93946b..9c87b9c45 100644 --- a/modules/security-permissions.js +++ b/modules/security-permissions.js @@ -1,3 +1,19 @@ +/* +Copyright 2006 - 2024 Intel Corporation + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + /** * MeshAgent Security Permissions Module * @@ -248,20 +264,17 @@ function setSecurePermissions(filePath, fileType, options) { if (currentUid === 0) { var group = (process.platform === 'darwin') ? policy.group : policy.groupLinux; - var chownCmd = 'chown ' + policy.owner + ':' + group + ' "' + filePath + '"'; - logger.debug('[SECURITY-PERMS] Setting ownership: ' + chownCmd); + var chownArg = policy.owner + ':' + group; + logger.debug('[SECURITY-PERMS] Setting ownership: chown ' + chownArg + ' "' + filePath + '"'); if (!options.dryRun) { try { - // Use execFile + waitExit for Duktape compatibility - var child = child_process.execFile('/bin/sh', ['sh']); + // Use execFile with argv array (no shell interpolation) for safety + var child = child_process.execFile('/usr/sbin/chown', ['chown', chownArg, filePath]); var stdout = ''; var stderr = ''; child.stdout.on('data', function(chunk) { stdout += chunk.toString(); }); child.stderr.on('data', function(chunk) { stderr += chunk.toString(); }); - child.stdin.write(chownCmd + '\n'); - child.stdin.write('echo "EXITCODE:$?"\n'); // Capture exit code - child.stdin.write('exit\n'); child.waitExit(); // Check for errors in stderr @@ -269,11 +282,6 @@ function setSecurePermissions(filePath, fileType, options) { throw new Error('chown stderr: ' + stderr.trim()); } - // Check exit code - if (stdout.indexOf('EXITCODE:0') === -1) { - throw new Error('chown returned non-zero exit code'); - } - logger.debug('[SECURITY-PERMS] Ownership set successfully'); } catch (e) { // Log as WARNING so it's visible even without DEBUG @@ -284,8 +292,8 @@ function setSecurePermissions(filePath, fileType, options) { logger.warn('[SECURITY-PERMS] ' + errMsg); } } else { - result.actions.push(chownCmd); - logger.debug('[SECURITY-PERMS] Dry-run: would execute ' + chownCmd); + result.actions.push('chown ' + chownArg + ' "' + filePath + '"'); + logger.debug('[SECURITY-PERMS] Dry-run: would execute chown ' + chownArg + ' "' + filePath + '"'); } } else { var skipMsg = 'Skipped chown (not running as root, UID: ' + currentUid + ')'; @@ -536,24 +544,18 @@ function createFileSecure(filePath, content, fileType) { if (process.platform !== 'win32' && process.getuid && process.getuid() === 0) { var group = (process.platform === 'darwin') ? policy.group : policy.groupLinux; try { - // Use execFile + waitExit for Duktape compatibility - var child = child_process.execFile('/bin/sh', ['sh']); + // Use execFile with argv array (no shell interpolation) for safety + var child = child_process.execFile('/usr/sbin/chown', ['chown', policy.owner + ':' + group, filePath]); var stdout = ''; var stderr = ''; child.stdout.on('data', function(chunk) { stdout += chunk.toString(); }); child.stderr.on('data', function(chunk) { stderr += chunk.toString(); }); - child.stdin.write('chown ' + policy.owner + ':' + group + ' "' + filePath + '"\n'); - child.stdin.write('echo "EXITCODE:$?"\n'); - child.stdin.write('exit\n'); child.waitExit(); // Check for errors if (stderr && stderr.trim().length > 0) { throw new Error('chown stderr: ' + stderr.trim()); } - if (stdout.indexOf('EXITCODE:0') === -1) { - throw new Error('chown returned non-zero exit code'); - } } catch (e) { // Log but don't fail - ownership may already be correct logger.warn('[SECURITY-PERMS] chown warning: ' + e.message); From 3292a92078151ea31cc43c722471d6706907f622 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 05:19:57 +0000 Subject: [PATCH 05/18] fix(MESHAGEN-004-2): 27 review findings across 18 files --- modules/_agentStatus.js | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/modules/_agentStatus.js b/modules/_agentStatus.js index 06342f1a0..9f2aa7d11 100644 --- a/modules/_agentStatus.js +++ b/modules/_agentStatus.js @@ -1,3 +1,18 @@ +/* +Copyright 2018 Intel Corporation + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ var promise = require('promise'); var nodeid = require('_agentNodeId')(); @@ -27,6 +42,7 @@ function dataHandler(chunk) } catch (x) { + console.log('Error processing Mesh Agent response: ' + x); } if ((len + 4) < chunk.length) { this.unshift(chunk.slice(4 + len)); } } @@ -95,4 +111,4 @@ function start() }).then(function (v) { console.log(v); }).then(function () { process._exit(); }).catch(function () { process._exit(); }); } -module.exports = { start: start, query: queryAgent }; \ No newline at end of file +module.exports = { start: start, query: queryAgent }; From 9cb92080ddcc14a1c3443cae22d7af9d31645847 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 05:19:59 +0000 Subject: [PATCH 06/18] fix(MESHAGEN-004-2): 27 review findings across 18 files --- meshcore/KVM/MacOS/mac_kvm_auth.h | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/meshcore/KVM/MacOS/mac_kvm_auth.h b/meshcore/KVM/MacOS/mac_kvm_auth.h index b549ed2bc..9c3f0d8a1 100644 --- a/meshcore/KVM/MacOS/mac_kvm_auth.h +++ b/meshcore/KVM/MacOS/mac_kvm_auth.h @@ -1,3 +1,19 @@ +/* +Copyright 2022 Intel Corporation + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + /* * mac_kvm_auth.h * From 5cbe74e907074d9b73a8bb5489df255102991e31 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 05:20:01 +0000 Subject: [PATCH 07/18] fix(MESHAGEN-004-2): 27 review findings across 18 files --- meshcore/KVM/MacOS/mac_events.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/meshcore/KVM/MacOS/mac_events.c b/meshcore/KVM/MacOS/mac_events.c index f1f053fe9..79f1f061a 100644 --- a/meshcore/KVM/MacOS/mac_events.c +++ b/meshcore/KVM/MacOS/mac_events.c @@ -1,3 +1,19 @@ +/* +Copyright 2006 - 2021 Intel Corporation + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + #include "mac_events.h" #include #include @@ -308,3 +324,4 @@ void KeyActionUnicode(uint16_t unicode, int up) CFRelease(key); } } + From 9d6424377448ccd761c5c9f049fd377ed5092722 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 05:20:03 +0000 Subject: [PATCH 08/18] fix(MESHAGEN-004-2): 27 review findings across 18 files --- meshcore/MacOS/mac_tcc_detection.h | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/meshcore/MacOS/mac_tcc_detection.h b/meshcore/MacOS/mac_tcc_detection.h index 05b5589e8..9689f956b 100644 --- a/meshcore/MacOS/mac_tcc_detection.h +++ b/meshcore/MacOS/mac_tcc_detection.h @@ -1,3 +1,20 @@ +/** +* @copyright Copyright 2018 Intel Corporation +* SPDX-License-Identifier: Apache-2.0 +* +* Licensed under the Apache License, Version 2.0 (the "License"); +* you may not use this file except in compliance with the License. +* You may obtain a copy of the License at +* +* http://www.apache.org/licenses/LICENSE-2.0 +* +* Unless required by applicable law or agreed to in writing, software +* distributed under the License is distributed on an "AS IS" BASIS, +* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +* See the License for the specific language governing permissions and +* limitations under the License. +*/ + #ifndef MAC_TCC_DETECTION_H #define MAC_TCC_DETECTION_H @@ -71,3 +88,4 @@ TCC_AllPermissions check_all_permissions(void); #endif #endif // MAC_TCC_DETECTION_H + From 07ffb1cdd03241cac64f67cdafa95d589c3668a6 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 05:20:05 +0000 Subject: [PATCH 09/18] fix(MESHAGEN-004-2): 27 review findings across 18 files --- meshcore/MacOS/mac_ui_helpers.h | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/meshcore/MacOS/mac_ui_helpers.h b/meshcore/MacOS/mac_ui_helpers.h index 55986968d..6af221870 100644 --- a/meshcore/MacOS/mac_ui_helpers.h +++ b/meshcore/MacOS/mac_ui_helpers.h @@ -1,3 +1,19 @@ +/* +Copyright 2024 Intel Corporation + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + #ifndef MAC_UI_HELPERS_H #define MAC_UI_HELPERS_H @@ -25,3 +41,4 @@ NSTextField* mesh_createLabel(NSString* text, NSRect frame, BOOL bold); #endif // MAC_UI_HELPERS_H + From 1f18cc3ee8a36d099b6e4533f8eb41c5acac2d75 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 05:20:07 +0000 Subject: [PATCH 10/18] fix(MESHAGEN-004-2): 27 review findings across 18 files --- meshreset/stdafx.cpp | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/meshreset/stdafx.cpp b/meshreset/stdafx.cpp index 09fe45bd0..223cb12c3 100644 --- a/meshreset/stdafx.cpp +++ b/meshreset/stdafx.cpp @@ -1,3 +1,19 @@ +/* +* Copyright 2021 Intel Corporation +* +* Licensed under the Apache License, Version 2.0 (the "License"); +* you may not use this file except in compliance with the License. +* You may obtain a copy of the License at +* +* http://www.apache.org/licenses/LICENSE-2.0 +* +* Unless required by applicable law or agreed to in writing, software +* distributed under the License is distributed on an "AS IS" BASIS, +* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +* See the License for the specific language governing permissions and +* limitations under the License. +*/ + // stdafx.cpp : source file that includes just the standard includes // TinyMesh.pch will be the pre-compiled header // stdafx.obj will contain the pre-compiled type information @@ -6,3 +22,4 @@ // TODO: reference any additional headers you need in STDAFX.H // and not in this file + From 63ee68c0ab05af05e45c4e105881dc98d10f849e Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 05:20:09 +0000 Subject: [PATCH 11/18] fix(MESHAGEN-004-2): 27 review findings across 18 files --- microscript/duk_module_duktape.h | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/microscript/duk_module_duktape.h b/microscript/duk_module_duktape.h index 8c8808104..b5d4374ff 100644 --- a/microscript/duk_module_duktape.h +++ b/microscript/duk_module_duktape.h @@ -1,3 +1,19 @@ +/* + * Copyright (c) 2024 Intel Corporation + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + #if !defined(DUK_MODULE_DUKTAPE_H_INCLUDED) #define DUK_MODULE_DUKTAPE_H_INCLUDED @@ -12,3 +28,4 @@ extern void duk_module_duktape_init(duk_context *ctx); #endif /* DUK_MODULE_DUKTAPE_H_INCLUDED */ + From 50e3acff22b2152ed21bc53a2209d1cf4861af5e Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 05:20:12 +0000 Subject: [PATCH 12/18] fix(MESHAGEN-004-2): 27 review findings across 18 files --- meshcore/MacOS/bundle_detection.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/meshcore/MacOS/bundle_detection.h b/meshcore/MacOS/bundle_detection.h index c82209656..cefee57bf 100644 --- a/meshcore/MacOS/bundle_detection.h +++ b/meshcore/MacOS/bundle_detection.h @@ -1,5 +1,5 @@ /* -Copyright 2025 +Copyright 2025 Intel Corporation Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. @@ -65,3 +65,4 @@ int adjust_working_directory_for_bundle(void); #endif /* __APPLE__ */ #endif /* MACOS_BUNDLE_DETECTION_H */ + From 3b9882be040718a2e208fed726d1039d9f3caecf Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 05:20:15 +0000 Subject: [PATCH 13/18] fix(MESHAGEN-004-2): 27 review findings across 18 files --- openframe/machine_id_reader.h | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/openframe/machine_id_reader.h b/openframe/machine_id_reader.h index 8b4162dbc..0b5bcdc04 100644 --- a/openframe/machine_id_reader.h +++ b/openframe/machine_id_reader.h @@ -1,3 +1,19 @@ +/* + * Copyright (c) 2024 Intel Corporation + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + #ifndef MACHINE_ID_READER_H #define MACHINE_ID_READER_H From 1f1a9843944577f668cf03f56c02b443a02ce6fd Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 05:20:18 +0000 Subject: [PATCH 14/18] fix(MESHAGEN-004-2): 27 review findings across 18 files --- samples/webrtc/C# Sample/FormExtensions.cs | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/samples/webrtc/C# Sample/FormExtensions.cs b/samples/webrtc/C# Sample/FormExtensions.cs index 1459b5a88..ebbe57715 100644 --- a/samples/webrtc/C# Sample/FormExtensions.cs +++ b/samples/webrtc/C# Sample/FormExtensions.cs @@ -1,4 +1,18 @@ -using System; +// Copyright (c) Intel Corporation +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +using System; using System.Collections.Generic; using System.Linq; using System.Text; @@ -11,3 +25,4 @@ public static class FormExtensions { } } + From af7baa05933ef581cf129fc1cfaff275a3de2ade Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 05:20:21 +0000 Subject: [PATCH 15/18] fix(MESHAGEN-004-2): 27 review findings across 18 files --- tests/security-permissions-test.js | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/tests/security-permissions-test.js b/tests/security-permissions-test.js index cb3c6af88..5c3f70422 100644 --- a/tests/security-permissions-test.js +++ b/tests/security-permissions-test.js @@ -1,3 +1,19 @@ +/** + * Copyright 2018-2025 Intel Corporation + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + /** * Unit tests for security-permissions module * @@ -357,3 +373,4 @@ if (testsFailed > 0) { console.log('\n✓ All tests passed!'); process.exit(0); } + From 705da7383230378085fda79369e1ab3d8ff8b906 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 05:20:24 +0000 Subject: [PATCH 16/18] fix(MESHAGEN-004-2): 27 review findings across 18 files --- microscript/duk_module_duktape.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/microscript/duk_module_duktape.c b/microscript/duk_module_duktape.c index e2616ba19..e7ee56d9e 100644 --- a/microscript/duk_module_duktape.c +++ b/microscript/duk_module_duktape.c @@ -1,3 +1,21 @@ +/* + * Copyright (C) 2023 Intel Corporation + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + * SPDX-License-Identifier: Apache-2.0 + */ + /* * Duktape 1.x compatible module loading framework */ @@ -469,3 +487,4 @@ void duk_module_duktape_init(duk_context *ctx) { #undef DUK__IDX_FRESH_REQUIRE #undef DUK__IDX_EXPORTS #undef DUK__IDX_MODULE + From 2c692b4b5bf8a9a6017545f6bf1a1a055b0e571d Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 05:20:27 +0000 Subject: [PATCH 17/18] fix(MESHAGEN-004-2): 27 review findings across 18 files --- docs/modules/apply_labels.py | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/docs/modules/apply_labels.py b/docs/modules/apply_labels.py index 42ee46c88..58f57c4d1 100644 --- a/docs/modules/apply_labels.py +++ b/docs/modules/apply_labels.py @@ -1,5 +1,19 @@ #!/usr/bin/env python3 +# Copyright 2024 Intel Corporation +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + import os import subprocess import re From a1ba52e0fd3de84904f0c87d599b43e4fd1aaad5 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 05:20:30 +0000 Subject: [PATCH 18/18] fix(MESHAGEN-004-2): 27 review findings across 18 files --- meshcore/KVM/MacOS/mac_tile.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/meshcore/KVM/MacOS/mac_tile.c b/meshcore/KVM/MacOS/mac_tile.c index 87ad10699..856f8fb6f 100644 --- a/meshcore/KVM/MacOS/mac_tile.c +++ b/meshcore/KVM/MacOS/mac_tile.c @@ -1,10 +1,19 @@ /* * mac_tile.c - * * - * Created by Ylian Saint-Hilaire on 8/18/11. - * Copyright 2011 __MyCompanyName__. All rights reserved. + * Copyright 2011 Intel Corporation * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. */ #include "mac_tile.h" @@ -544,3 +553,4 @@ void set_tile_compression(int type, int level) // TODO Make sure the all the types are handled. We ignore the type variable for now. } +