fix(adhoc-sweep-fixes): CU-86akbhh7d 40 review findings across 40 files

frontend/components/ActivityItem/ActivityItem.tsx

@@ -91,11 +91,10 @@ const ActivityItem = ({
     ? addGravatarUrlToResource({ email: actor_email })
     : { gravatar_url: undefined };
 
-  // wrapped just in case the date string does not parse correctly
-  let activityCreatedAt: Date;
-  try {
-    activityCreatedAt = new Date(activity.created_at);
-  } catch (e) {
+  // Date constructor never throws on invalid input, it returns an Invalid
+  // Date object instead, so we explicitly check for that and fall back.
+  let activityCreatedAt = new Date(activity.created_at);
+  if (isNaN(activityCreatedAt.getTime())) {
     activityCreatedAt = new Date();
   }
 

frontend/components/FileUploader/FileUploader.tsx

@@ -1,4 +1,4 @@
-import React, { useState, useRef } from "react";
+import React, { useState, useRef, useId } from "react";
 import classnames from "classnames";
 
 import Button from "components/buttons/Button";
@@ -114,6 +114,7 @@ export const FileUploader = ({
 }: IFileUploaderProps) => {
   const [isFileSelected, setIsFileSelected] = useState(!!fileDetails);
   const fileInputRef = useRef<HTMLInputElement>(null);
+  const fileInputId = useId();
 
   const classes = classnames(baseClass, className, {
     [`${baseClass}__file-preview`]: isFileSelected,
@@ -176,7 +177,7 @@ export const FileUploader = ({
     // If we want to actual do file uploading, wrap in a label that
     // references the hidden file input. Otherwise just use a span.
     if (!onButtonClick) {
-      buttonMarkup = <label htmlFor="upload-file">{buttonMarkup}</label>;
+      buttonMarkup = <label htmlFor={fileInputId}>{buttonMarkup}</label>;
     } else {
       buttonMarkup = <span>{buttonMarkup}</span>;
     }
@@ -268,7 +269,7 @@ export const FileUploader = ({
             <input
               ref={fileInputRef}
               accept={accept}
-              id="upload-file"
+              id={fileInputId}
               type="file"
               onChange={onFileSelect}
               className="file-input-visually-hidden"

frontend/components/forms/fields/SelectTargetsDropdown/SelectTargetsDropdown.jsx

@@ -63,6 +63,9 @@ class SelectTargetsDropdown extends Component {
 
   componentWillUnmount() {
     this.mounted = false;
+    if (this.lookForOuterMenu) {
+      clearInterval(this.lookForOuterMenu);
+    }
   }
 
   onInputClose = () => {
@@ -86,11 +89,20 @@ class SelectTargetsDropdown extends Component {
     const { document } = global;
     const { wrapperHeight } = this;
 
-    const lookForOuterMenu = setInterval(() => {
+    this.lookForOuterMenu = setInterval(() => {
+      if (!this.mounted) {
+        clearInterval(this.lookForOuterMenu);
+        return;
+      }
+
       if (document.querySelectorAll(".Select-menu-outer")) {
-        clearInterval(lookForOuterMenu);
+        clearInterval(this.lookForOuterMenu);
         const coreWrapper = document.querySelector(".core-wrapper");
 
+        if (!coreWrapper) {
+          return;
+        }
+
         const currentWrapperHeight = coreWrapper.scrollHeight;
         if (wrapperHeight < currentWrapperHeight) {
           coreWrapper.style.height = `${

frontend/pages/ManageControlsPage/OSUpdates/OSUpdates.tsx

@@ -111,6 +111,7 @@ const OSUpdates = ({ router, teamIdForApi, queryParams }: IOSUpdates) => {
         fleet_id: teamIdForApi,
       })
     );
+    return null;
   }
 
   // FIXME: Handle error states for app config and team config (need specifications for this).

frontend/pages/ManageControlsPage/SetupExperience/cards/BootstrapPackage/components/DeleteBootstrapPackageModal/DeleteBootstrapPackageModal.tsx

@@ -29,7 +29,7 @@ const DeleteBootstrapPackageModal = ({
         <p>
           Option to install Fleet&apos;s agent (fleetd) manually will be
           disabled, so agent will be installed automatically during automatic
-          enollment of macOS hosts.
+          enrollment of macOS hosts.
         </p>
         <div className="modal-cta-wrap">
           <Button type="button" onClick={() => onDelete()} variant="alert">
@@ -45,3 +45,4 @@ const DeleteBootstrapPackageModal = ({
 };
 
 export default DeleteBootstrapPackageModal;
+

frontend/pages/SoftwarePage/components/tables/SoftwareVulnerabilitiesTable/SoftwareVulnerabilitiesTable.tsx

@@ -108,7 +108,7 @@ const SoftwareVulnerabilitiesTable = ({
 
   const tableHeaders = useMemo(
     () => generateTableConfig(Boolean(isPremiumTier), router, teamIdForApi),
-    [isPremiumTier]
+    [isPremiumTier, router, teamIdForApi]
   );
 
   const renderVulnerabilitiesCount = () => (

frontend/pages/admin/IntegrationsPage/cards/Integrations/components/IntegrationForm/IntegrationForm.tsx

@@ -22,7 +22,7 @@ const baseClass = "integration-form";
 interface IIntegrationFormProps {
   onCancel: () => void;
   onSubmit: (
-    untegrationSubmitData: IIntegration[],
+    integrationSubmitData: IIntegration[],
     integrationDestination: string
   ) => void;
   integrationEditing?: IIntegrationTableData;

frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/EditTeamsAbmModal/EditTeamsAbmModal.tsx

@@ -93,14 +93,7 @@ const EditTeamsAbmModal = ({
     }
   );
 
-  const options = useMemo(() => {
-    return availableTeams
-      ?.filter((t) => t.name !== "All fleets")
-      .map((t) => ({
-        value: t.name,
-        label: t.name,
-      }));
-  }, [availableTeams]);
+  const options = useMemo(() => getOptions(availableTeams), [availableTeams]);
 
   const onSave = useCallback(
     async (evt: React.MouseEvent<HTMLFormElement>) => {

frontend/pages/admin/ManageUsersPage/EditUserPage/EditUserPage.tsx

@@ -128,8 +128,7 @@ const EditUserPage = ({ router, params, location }: IEditUserPageProps) => {
       requestData.mfa_enabled = formData.mfa_enabled;
     if (formData.global_role !== entityData.global_role)
       requestData.global_role = formData.global_role;
-    if (formData.teams && formData.teams.length > 0)
-      requestData.teams = formData.teams;
+    if (formData.teams) requestData.teams = formData.teams;
     if (formData.new_password) requestData.new_password = formData.new_password;
 
     let successMessage = `Successfully edited ${formData.name}`;

frontend/pages/hosts/details/cards/Policies/HostPoliciesTable/PolicyFailingCount/PolicyFailingCount.tsx

@@ -47,7 +47,7 @@ const PolicyFailingCount = ({
           blocking login
         </strong>
         <br />
-        To restore access, click on the policies makes &quot;Action
+        To restore access, click on the policies marked &quot;Action
         required&quot; and follow the resolution steps.
         {deviceUser && ' Once resolved, click "Refetch" to check status.'}
       </span>

frontend/test/handlers/device-handler.ts

@@ -93,7 +93,7 @@ export const emptySetupExperienceHandler = deviceSetupExperienceHandler({
 });
 
 export const getDeviceVppCommandResultHandler = http.get(
-  `/device/:token/software/commands/:uuid/results`,
+  baseUrl(`/device/:token/software/commands/:uuid/results`),
   ({ params }) => {
     const { uuid } = params;
 
@@ -119,3 +119,4 @@ export const getDeviceVppCommandResultHandler = http.get(
     });
   }
 );
+

frontend/utilities/software_uninstall_scripts.ts

@@ -26,6 +26,7 @@ const getDefaultUninstallScript = (fileName: string): string => {
     case "rpm":
       return uninstallRPM;
     case "exe":
+    case "zip":
     case "tar.gz":
     case "sh":
     case "ps1":

it-and-security/lib/linux/scripts/uninstall-fleetd-linux.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# Please don't delete. This script is used in tests (tools/tuf/test/migration/migration_test.sh), workflors (.github/workflows/), and in the guide here: https://fleetdm.com/guides/how-to-uninstall-fleetd
+# Please don't delete. This script is used in tests (tools/tuf/test/migration/migration_test.sh), workflows (.github/workflows/), and in the guide here: https://fleetdm.com/guides/how-to-uninstall-fleetd
 
 if [ $(id -u) -ne 0 ]; then
     echo "Please run as root"
@@ -54,3 +54,4 @@ else
         bash -c "bash $0 remove >/dev/null 2>/dev/null </dev/null &"
     fi
 fi
+

orbit/pkg/cryptoinfo/info.go

@@ -18,7 +18,7 @@ type KeyInfo struct {
 type kiDataNames string
 
 const (
-	kiCaCertificate kiDataNames = "certificate"
+	kiCaCertificate kiDataNames = "ca_certificate"
 	kiCertificate   kiDataNames = "certificate"
 	kiKey           kiDataNames = "key"
 )
@@ -117,3 +117,4 @@ func (ki *KeyInfo) MarshalJSON() ([]byte, error) {
 
 	return json.Marshal(ret)
 }
+

orbit/pkg/platform/platform_notwindows.go

@@ -76,7 +76,6 @@ func GetProcessesByName(name string) ([]*gopsutil_process.Process, error) {
 
 		if strings.HasPrefix(processName, name) {
 			foundProcesses = append(foundProcesses, process)
-			break
 		}
 	}
 
@@ -119,3 +118,4 @@ func killProcessByName(name string) error {
 
 	return nil
 }
+

orbit/pkg/table/diskutil/apfs/apfs_darwin.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"os/exec"
 	"strconv"
+	"time"
 
 	"github.com/osquery/osquery-go/plugin/table"
 	"howett.net/plist"
@@ -71,7 +72,10 @@ func VolumesColumns() []table.ColumnDefinition {
 // Generate is called to return the results for the table at query time.
 // Constraints for generating can be retrieved from the queryContext.
 func VolumesGenerate(ctx context.Context, queryContext table.QueryContext) ([]map[string]string, error) {
-	cmd := exec.Command("/usr/sbin/diskutil", "apfs", "list", "-plist")
+	ctx, cancel := context.WithTimeout(ctx, 30*time.Second)
+	defer cancel()
+
+	cmd := exec.CommandContext(ctx, "/usr/sbin/diskutil", "apfs", "list", "-plist")
 	out, err := cmd.Output()
 	if err != nil {
 		return nil, fmt.Errorf("generate failed: %w", err)
@@ -141,7 +145,10 @@ func PhysicalStoresColumns() []table.ColumnDefinition {
 // Generate is called to return the results for the table at query time.
 // Constraints for generating can be retrieved from the queryContext.
 func PhysicalStoresGenerate(ctx context.Context, queryContext table.QueryContext) ([]map[string]string, error) {
-	cmd := exec.Command("/usr/sbin/diskutil", "apfs", "list", "-plist")
+	ctx, cancel := context.WithTimeout(ctx, 30*time.Second)
+	defer cancel()
+
+	cmd := exec.CommandContext(ctx, "/usr/sbin/diskutil", "apfs", "list", "-plist")
 	out, err := cmd.Output()
 	if err != nil {
 		return nil, fmt.Errorf("generate failed: %w", err)

orbit/pkg/table/tcc_access/tcc_access.go

@@ -10,6 +10,7 @@ import (
 	"fmt"
 	"os"
 	"os/exec"
+	"strconv"
 	"strings"
 
 	"github.com/osquery/osquery-go/plugin/table"
@@ -164,6 +165,10 @@ func buildTableRows(uid string, parsedRows [][]string) ([]map[string]string, err
 }
 
 func satisfiesConstraints(uid string, constraints []table.Constraint) (bool, error) {
+	uidNum, err := strconv.ParseInt(uid, 10, 64)
+	if err != nil {
+		return false, fmt.Errorf("failed to parse uid %q as integer: %w", uid, err)
+	}
 	for _, constraint := range constraints {
 		// for each constraint on the column
 		switch constraint.Operator {
@@ -172,19 +177,35 @@ func satisfiesConstraints(uid string, constraints []table.Constraint) (bool, err
 				return false, nil
 			}
 		case table.OperatorGreaterThan:
-			if constraint.Expression >= uid {
+			exprNum, err := strconv.ParseInt(constraint.Expression, 10, 64)
+			if err != nil {
+				return false, fmt.Errorf("failed to parse uid constraint expression %q as integer: %w", constraint.Expression, err)
+			}
+			if exprNum >= uidNum {
 				return false, nil
 			}
 		case table.OperatorLessThan:
-			if constraint.Expression <= uid {
+			exprNum, err := strconv.ParseInt(constraint.Expression, 10, 64)
+			if err != nil {
+				return false, fmt.Errorf("failed to parse uid constraint expression %q as integer: %w", constraint.Expression, err)
+			}
+			if exprNum <= uidNum {
 				return false, nil
 			}
 		case table.OperatorGreaterThanOrEquals:
-			if constraint.Expression > uid {
+			exprNum, err := strconv.ParseInt(constraint.Expression, 10, 64)
+			if err != nil {
+				return false, fmt.Errorf("failed to parse uid constraint expression %q as integer: %w", constraint.Expression, err)
+			}
+			if exprNum > uidNum {
 				return false, nil
 			}
 		case table.OperatorLessThanOrEquals:
-			if constraint.Expression < uid {
+			exprNum, err := strconv.ParseInt(constraint.Expression, 10, 64)
+			if err != nil {
+				return false, fmt.Errorf("failed to parse uid constraint expression %q as integer: %w", constraint.Expression, err)
+			}
+			if exprNum < uidNum {
 				return false, nil
 			}
 		default:

pkg/fleetdbase/fleetd_base.go

@@ -1,4 +1,4 @@
-// pacakge fleetdbase contains functions to interact with downloads.fleetdm.com
+// package fleetdbase contains functions to interact with downloads.fleetdm.com
 package fleetdbase
 
 import (

server/cron/calendar_cron.go

@@ -339,7 +339,9 @@ func processFailingHostExistingCalendarEvent(
 			return errors.New("could not reserve calendar lock")
 		}
 		lockReserved = true
-		done := make(chan struct{})
+		// done is buffered so the goroutine below can always send its result and exit,
+		// even if the outer select below has already timed out and stopped listening.
+		done := make(chan struct{}, 1)
 		go func() {
 			for {
 				// Keep trying to get the lock.

server/datastore/mysql/jobs_test.go

@@ -21,7 +21,7 @@ func TestJobs(t *testing.T) {
 		fn   func(t *testing.T, ds *Datastore)
 	}{
 		{"QueueAndProcessJobs", testQueueAndProcessJobs},
-		{"QueueAndProcessJobs", testQueueAndProcessFilteredJobs},
+		{"QueueAndProcessFilteredJobs", testQueueAndProcessFilteredJobs},
 		{"CleanupWorkerJobs", testCleanupWorkerJobs},
 	}
 	for _, c := range cases {

server/datastore/mysql/migrations/tables/20220524102918_CleanupOrphanedPolicyMemberships_test.go

@@ -17,7 +17,7 @@ func TestUp_20220524102918(t *testing.T) {
 	teamID, err := res.LastInsertId()
 	require.NoError(t, err)
 
-	_, err = db.Exec(`
+	res, err = db.Exec(`
     INSERT INTO policies (name, query, description, team_id)
     VALUES ('test_policy', "", "", ?)
   `, teamID)

server/datastore/mysql/migrations/tables/20240829170023_CreateVPPTokenTeamsJoinTable.go

@@ -10,7 +10,6 @@ func init() {
 }
 
 func Up_20240829170023(tx *sql.Tx) error {
-	// Idempotent migration.
 	// Idempotent migration.
 	_, err := tx.Exec(`
 CREATE TABLE IF NOT EXISTS vpp_token_teams (

server/datastore/mysql/migrations/tables/20241210140021_AddErrorsToCronStatsTable.go

@@ -6,10 +6,10 @@ import (
 )
 
 func init() {
-	MigrationClient.AddMigration(Up_20241126140021, Down_20241126140021)
+	MigrationClient.AddMigration(Up_20241210140021, Down_20241210140021)
 }
 
-func Up_20241126140021(tx *sql.Tx) error {
+func Up_20241210140021(tx *sql.Tx) error {
 	// Idempotent migration.
 	// Add columns
 	if !columnExists(tx, "cron_stats", "errors") {
@@ -21,6 +21,6 @@ func Up_20241126140021(tx *sql.Tx) error {
 	return nil
 }
 
-func Down_20241126140021(tx *sql.Tx) error {
+func Down_20241210140021(tx *sql.Tx) error {
 	return nil
 }

server/datastore/mysql/migrations/tables/20251028140000_CreateTableOSVersionVulnerabilities.go

@@ -61,7 +61,7 @@ func Up_20251028140000(tx *sql.Tx) error {
 		FROM kernel_host_counts khc
 		JOIN software_cve sc ON sc.software_id = khc.software_id
 		WHERE khc.hosts_count > 0
-		GROUP BY khc.team_id, khc.os_version_id, sc.cve, khc.team_id
+		GROUP BY khc.team_id, khc.os_version_id, sc.cve
 		ON DUPLICATE KEY UPDATE
 			source = VALUES(source),
 			resolved_in_version = VALUES(resolved_in_version),

server/datastore/mysql/migrations/tables/20260518194422_AddEncodingTypeToHostSCDData.go

@@ -9,7 +9,7 @@ func init() {
 	MigrationClient.AddMigration(Up_20260518194422, Down_20260518194422)
 }
 
-// Up_20260514220719 adds the encoding_type column that discriminates between
+// Up_20260518194422 adds the encoding_type column that discriminates between
 // the legacy dense bitmap format (encoding_type = 0) and the new roaring
 // bitmap format (encoding_type = 1). ALGORITHM=INSTANT is a metadata-only
 // change on MySQL 8.0+; existing rows are not rewritten and read back with
@@ -32,3 +32,4 @@ func Up_20260518194422(tx *sql.Tx) error {
 func Down_20260518194422(tx *sql.Tx) error {
 	return nil
 }
+