SimplrSSH - Code Scan - 2026-10-18

[bluenevus]

Findings

1. Low - main/ssh_terminal.cpp (console ssh / sshkey commands, ~lines 980 and 1007): the port is parsed with atoi and never range-checked. htons() in ssh_begin() wraps e.g. 65558 to 22, and known_hosts keys on the unwrapped value. This is a user-typed input only, so it is a correctness and host-key-bookkeeping issue, not remotely exploitable.

Reviewed with no finding: unsafe C string functions (none), TLS verification (CA bundle on OpenAI and portal clients, no verify-off), portal URL/port parsing (bounded), workflow permissions and SHA pinning (only the documented sast-rules@main exception), and the previous code-scan branch (already merged).

Plan

Validate the port in ssh_begin(), the single path every connection goes through. Files: main/ssh_terminal.cpp. Verify with the guard tests.

Final gap analysis

• Port range check: done.
• Dependency audit: not done. No audit tool is available in this environment, and the Tests workflow audit was moved to the Security scan workflow.
• Host unit tests and SAST: not done locally. The host tests need libmbedtls-dev (missing), and SAST needs docker with ECR login. CI will run them.
• Firmware build: not done. ESP-IDF is not available here. Nothing was confirmed on a real T-Deck or Tab5.

Deferred

None.

Verification

• cd test/guards && python3 -m unittest test_supply_chain test_firmware_rules test_rules_file test_ci_scripts - 97 tests, OK
• SKIP_SAST=1 scripts/check.sh - guards passed; the host build failed at CMake configure (mbedcrypto not found), so host tests did not run.

---

Generated by Claude Code