ParadoxAlarmInterface/pai

Use user code from panel to validate partition control messages

Open

#142 opened on Mar 5, 2020

View on GitHub
 (19 comments) (0 reactions) (0 assignees)Python (113 forks)auto 404
enhancementhelp wantedprotocol

Repository metrics

Stars
 (414 stars)
PR merge metrics
 (PR metrics pending)

Description

With current implementation any of the client can send a partition control message to pai and easily disarm the system. From the overall system perspective it can lead to a vulnerability.

Disarming should be only possible if a user code is sent back as part of the payload. The sent user code should be validated against the user code(s) in the alarm panel. If the user code is found in the alarm panel the system should make the state change on behalf of the found user. In every other cases the request should be rejected.

Contributor guide

Research direction
Examine the current handling of partition control messages and locate where disarming is permitted. Investigate how user codes are stored and validated in the alarm panel, then design a check that requires a valid user code in the payload.
Tech stack
python
Domain
backend
Issue type
Security
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-2 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
PythonGit
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
55