fix: remediate Zscaler connector findings - #41
Merged
Conversation
Update repository checks and apply generated metadata and lint refreshes. The temporary release-note entry will be replaced by the first functional fix. Written by Codex.
Validate numeric user and group IDs and percent-encode category and destination-group path segments before REST endpoint construction. Tracks PSAAS-30672, PSAAS-31140, and PSAAS-31164 (VULN-93397, VULN-93865, VULN-93889; FS-1463, FS-1989, FS-2015). Written by Codex.
Apply Django JavaScript-context escaping before passing submitted-file hashes to context menus. Tracks PSAAS-30766 (VULN-93491, FS-1576). Written by Codex.
Activate blocklist, allowlist, URL-category, and destination-group mutations before reporting successful enforcement. Tracks PSAAS-31738 and PSAAS-32377 (VULN-94463, VULN-95100; FS-2985, FS-3623). Written by Codex.
Retain the current non-editable flag when an edit request does not explicitly provide a replacement. Tracks PSAAS-31749 (VULN-94474, FS-2996). Written by Codex.
Reject insecure sandbox base URLs before the legacy API token can be sent as a required query parameter. Tracks PSAAS-31770 (VULN-94495, FS-3017). Written by Codex.
Parse Retry-After values defensively and limit any single peer-directed sleep to 60 seconds. Tracks PSAAS-32059 (VULN-94783, FS-3306). Written by Codex.
Use action locks for whole-list allow and unallow operations so concurrent runs cannot overwrite each other. Tracks PSAAS-32409 (VULN-95132, FS-3655). Written by Codex.
|
Merging this PR will release 3.0.2 (2026-07-16)Connector release changes
Generated by Codex through the connector semantic-release preview workflow. |
phantom-jacob
marked this pull request as ready for review
July 16, 2026 20:49
sodle-splunk
approved these changes
Jul 16, 2026
|
🎉 This PR is included in version 3.0.2 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
1 task
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Tracking
Verification
pre-commit run --all-filespython3 -m py_compile zscaler_connector.py zscaler_consts.pygit diff --checkPatch review
Flashpoint patches were adapted to current source. The three path-injection reports share one structural endpoint-safety fix, and the two staged-policy reports share one activation fix; each distinct user-visible behavior has one signed commit and one release-note item. The legacy sandbox endpoint requires its token as a query parameter, so this connector change requires HTTPS rather than inventing an unsupported header scheme.
No breaking connector metadata changes are intended.
Written by Codex.