Feature/protocol #259
Feature/protocol #259
Conversation
…s into feature/protocol
|
Coverity detected 6 issues; a security concern. |
| "result": { | ||
| "name": "token", | ||
| "value": { | ||
| "value": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c", |
There was a problem hiding this comment.
Low impact. Security issue.
Sigma. Hard-coded secret.
A secret, such as a password, cryptographic key, or token is stored in plaintext directly in the source code, in an application's properties, or configuration file. Users with access to the secret may then use the secret to access resources that they otherwise would not have access to.
| "result": { | ||
| "name": "token", | ||
| "value": { | ||
| "value": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c", |
There was a problem hiding this comment.
Low impact. Security issue.
Sigma. Hard-coded secret.
A secret, such as a password, cryptographic key, or token is stored in plaintext directly in the source code, in an application's properties, or configuration file. Users with access to the secret may then use the secret to access resources that they otherwise would not have access to.
| "result": { | ||
| "name": "token", | ||
| "value": { | ||
| "value": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c", |
There was a problem hiding this comment.
Low impact. Security issue.
Sigma. Hard-coded secret.
A secret, such as a password, cryptographic key, or token is stored in plaintext directly in the source code, in an application's properties, or configuration file. Users with access to the secret may then use the secret to access resources that they otherwise would not have access to.
| "params": [], | ||
| "result": { | ||
| "name": "token", | ||
| "value": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c" |
There was a problem hiding this comment.
Low impact. Security issue.
Sigma. Hard-coded secret.
A secret, such as a password, cryptographic key, or token is stored in plaintext directly in the source code, in an application's properties, or configuration file. Users with access to the secret may then use the secret to access resources that they otherwise would not have access to.
| "params": [], | ||
| "result": { | ||
| "name": "token", | ||
| "value": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c" |
There was a problem hiding this comment.
Low impact. Security issue.
Sigma. Hard-coded secret.
A secret, such as a password, cryptographic key, or token is stored in plaintext directly in the source code, in an application's properties, or configuration file. Users with access to the secret may then use the secret to access resources that they otherwise would not have access to.
| "params": [], | ||
| "result": { | ||
| "name": "token", | ||
| "value": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c" |
There was a problem hiding this comment.
Low impact. Security issue.
Sigma. Hard-coded secret.
A secret, such as a password, cryptographic key, or token is stored in plaintext directly in the source code, in an application's properties, or configuration file. Users with access to the secret may then use the secret to access resources that they otherwise would not have access to.
Standardizing Intent Message requirements
In additional to traditional discovery APIs such as Watch History and Watch Next, Firebolt provides a more abstract API that facilitates impromptu content discovery connections between first-party Aggregated Experiences and third-party Apps. The User Interest Capability enables Apps to provide meta-data on content that the user has expressed an interest in to Aggregated Experience Apps that have been given access to use this Capability. This allows for open ended design of Aggregated Experience App features that present App-specific content to re-engage the user with the content inside the originating App. While the functionality and UX is left to the Aggregated Experience App, typically designed by each Firebolt Distributor, the Firebolt API enables events to register user interest and pass entity meta-data. Which generally enables Aggregated Experiences to present that entity meta-data in some way that leads to re-launching the original App at a later point, using a `navigateTo` notification. This is just one example of what an Aggregated Experience App might do with the User Interest API. Note that this API **SHOULD NOT** be used to implement Watch History or Watch Next features. These concepts are much more fundamental to Firebolt and have explicit APIs so that Firebolt Distributors can keep track of which apps are using them separately.
# [1.2.0-next.3](v1.2.0-next.2...v1.2.0-next.3) (2024-06-06) ### Features * User Interest ([#170](#170)) ([48a1094](48a1094))
* feat: Command and Control Intents * Addition of the intents to control Firebolt compliant devices. Control intents are for user intentions that will be needed regardless of whether there are any apps installed such as Power Intents, Volume Intents, Channel Intents, Media Control Intents
# [1.2.0-next.4](v1.2.0-next.3...v1.2.0-next.4) (2024-06-06) ### Features * Command and Control Intents ([#251](#251)) ([c8f8dae](c8f8dae))
* chore(capabilities): Adding missing specs * fix: Cleanup of Capabilities requirements * Remove dangling requirements or replaced them with "This concept is out of scope for this document"
* fix: Remove x-alternatives that don't exist * fix: Cut ProviderPolicy from App Pass-through
# [1.2.0-next.5](v1.2.0-next.4...v1.2.0-next.5) (2024-06-13) ### Bug Fixes * Remove x-alternatives that don't exist ([#278](#278)) ([e38ad5a](e38ad5a))
It's just ["object", "null"] and it's an optional parameter, so we can leave it undefined instead of passing null
No description provided.