CAP-Warn Security & Bug Review Report

[SEC-001] Command injection via unescaped shell arguments

Multiple exec()/shell_exec() calls interpolate variables without escapeshellarg(). $action is built from config, API text, and filesystem paths and passed to sox. $node is passed unescaped to asl-tts and sudo asterisk. $device from glob() is unescaped in cat command.

Related: usr/share/cap-warn/cap_warn.php:498

[SEC-002] API keys and tokens stored without restrictive permissions

setup.sh writes /etc/cap-warn/config.php with VoiceRSS key, Pushover user key, and API token. No chmod 600 or ownership hardening applied.

Related: usr/share/cap-warn/setup_text.sh:251-275

[SEC-003] Secrets written to install logs in plaintext

Full VoiceRSS API key logged to /var/log/cap-warn/install.log. Summary screen includes Pushover key and token.

[SEC-004] World-writable runtime state files

Sets /tmp/alert*, /tmp/warn*, /tmp/cyclone* files to chmod 666.

Related: usr/bin/cap_warn:12-18

[SEC-005] Hub mute flag controllable by any local user

Creates /tmp/linked_true.txt with no privilege check. cap_warn.php aborts all playback when this file exists.

Related: etc/cap-warn/advanced_config.php:49, usr/share/cap-warn/cap_warn.php:157-163

[SEC-006] Overly permissive TTS temp directory

mkdir($ttsDir, 0777, true) for /tmp/tts — world-writable directory.

[SEC-007] VoiceRSS API defaults to HTTP

URL is http://api.voicerss.org/ unless ssl is set in settings. TTS text and API key sent in cleartext.

[SEC-008] No TLS hardening on external HTTP clients

cURL calls to NWS/NHC with no explicit TLS options (min version, pinning). Pushover uses HTTPS but lacks response validation.

[SEC-009] Privilege escalation via sudo Asterisk

Runs sudo asterisk -rx with interpolated $node. Compromised config.php $node can inject Asterisk CLI commands.

[SEC-010] Unbounded log growth / sensitive data in archives

archive_json() appends full alert JSON to archive.log with no size cap. sound_cache.csv grows via FILE_APPEND without bounds.

[SEC-011] Pushover messages lack input sanitization

Weather/cyclone/Pi status text passed directly to Pushover without length or content filtering.

[BUG-001] Assignment (=) instead of comparison (==) — breaks Pi pushover modes

if($pushNotify = "pi_pushover") assigns and is always true. Clears $action and suppresses voice regardless of configured mode.

[BUG-002] Call to undefined function add_word()

Calls add_word($in) on TTS failure paths, but add_word() is fully commented out (lines 1060-1085).

[BUG-003] Severe weather "seek shelter" audio never plays (case bug)

Event names lowercased with strtolower(), then compared to mixed-case strings like "Tornado Warning". Comparisons never match.

[BUG-004] Undefined variable $high — emergency temperature tier broken

if ($temp >= $high) references $high which is never defined. Only commented in advanced_config.php line 38.

[BUG-005] Missing global $node in check_sound()

check_sound() uses $node in asl-tts command (line 977) without declaring global $node.

[BUG-006] Cyclone module: quiet hours broken when run standalone

Uses $hour and $day for sleep mute, but neither is set in cap_cyclones.php.

[BUG-007] Setup script typo: $PIALARMS vs $piAlarms

if [ "$PIALARMS" != "true" ] — $PIALARMS is never set; should be $piAlarms.

[BUG-008] Double PHP closing tag in advanced config

Two ?> closers. Trailing ?> can emit whitespace and cause "headers already sent" in web context.

[BUG-009] Wrong vcgencmd invocation

exec("sudo /usr/bin/vcgencmd measure_temp 2", ...) — literal 2 passed as argument, not stderr redirection.

[BUG-010] Cyclone playback picks wrong file when VoiceRSS fails

if ($tts) uses cycloneWAV else cycloneUL — ignores build_tts_audio() return value which may be .ul via asl-tts fallback.

[BUG-011] merge_alerts() crashes on invalid JSON

If cached file exists but json_decode() returns null, $pointData["features"] causes fatal error.

[BUG-012] isNewCycloneAdvisory() marks storm announced before playback

Appends storm key to cyclone_key.log before audio is built or played.

[BUG-013] Misleading hold-flag message; playback not fully skipped

Logs "Skipping playback — still within hold window" but does not return or set skip flag. New alerts still play.

[BUG-014] Inverted/confusing low-voltage counter logic

$LoV_limit comment says "max alarms per day" but logic suppresses while count <= limit. Opposite pattern from $uv_limit. $LoV__counter defined but never used.

[BUG-015] Empty Pushover notifications for temperature

$out initialized as "" and never set to temperature message before send_pushover_notification($out).

[BUG-016] fetchCapAlerts() deletes cache on network failure

unlink($cacheFile) on HTTP failure removes last good alert data.

[BUG-017] fetchZoneAlerts() may reference undefined $elapsed

Prints $elapsed after loop; if both zone URLs fail, variable may be unset.

[BUG-018] serial() deletes instance.id on every run

Unlinks /etc/cap-warn/instance.id every time serial() runs.

[BUG-019] Setup references undefined $BACKUP

Completion dialog shows $BACKUP but variable is never assigned.

[BUG-020] Placeholder config forces die until setup runs

Ships as die stub until setup runs. Mis-deployed package breaks all cron runs.

[BUG-021] Clash-file mutual exclusion is weak

Waits 90s if clash file exists, then writes own flag. No file locking; race between concurrent cron instances.

[BUG-022] GPS coordinate validation strips but does not validate range

Strips non-numeric chars from lat/lon but does not validate -90..90 / -180..180.

[BUG-023] $reportAll config option unused

$reportAll=false documented for temp debugging but never referenced in cap_temp.php.

[LOW-001] Deprecated <> operator

Uses <> (deprecated alias for !=).

[LOW-002] cvlc path quoting fragile

cvlc invoked with single-quoted $file — breaks if path contains apostrophe.

[LOW-003] Misleading cyclone log message

Prints "Hurricanes Active" in else branch when hurOnly is false (all tropical systems).

[LOW-004] Throttle sound lookup likely fails

Throttle messages joined with "_ " produce names like under-voltage-detected_ arm-frequency-capped.

[LOW-005] GPS HDOP rating typo

Typo "Greatt" in GPS HDOP rating string.