[Security] Fix CRITICAL vulnerability: V-001

src/common/LanguageModelProvider/FoundryLocalModelProvider.cs

@@ -12,6 +12,7 @@ namespace LanguageModelProvider;
 
 public sealed class FoundryLocalModelProvider : ILanguageModelProvider
 {
+    private const string LocalServiceApiKey = "none";
     private FoundryClient? _foundryClient;
     private IEnumerable<FoundryCatalogModel>? _catalogModels;
     private string? _serviceUrl;
@@ -63,7 +64,7 @@ public sealed class FoundryLocalModelProvider : ILanguageModelProvider
         Logger.LogInfo($"[FoundryLocal] Creating OpenAI client with endpoint: {endpointUri}");
 
         return new OpenAIClient(
-            new ApiKeyCredential("none"),
+            new ApiKeyCredential(LocalServiceApiKey),
             new OpenAIClientOptions { Endpoint = endpointUri, NetworkTimeout = TimeSpan.FromMinutes(5) })
             .GetChatClient(modelId)
             .AsIChatClient();
@@ -87,7 +88,7 @@ public string GetIChatClientString(string url)
             return string.Empty;
         }
 
-        return $"new OpenAIClient(new ApiKeyCredential(\"none\"), new OpenAIClientOptions{{ Endpoint = new Uri(\"{_serviceUrl}/v1\") }}).GetChatClient(\"{modelId}\").AsIChatClient()";
+        return $"new OpenAIClient(new ApiKeyCredential(\"{LocalServiceApiKey}\"), new OpenAIClientOptions{{ Endpoint = new Uri(\"{_serviceUrl}/v1\") }}).GetChatClient(\"{modelId}\").AsIChatClient()";
     }
 
     public async Task<IEnumerable<ModelDetails>> GetModelsAsync(CancellationToken cancelationToken = default)

src/common/ManagedCommon/ThemeListener.cs

@@ -31,9 +31,13 @@ public partial class ThemeListener : IDisposable
         public ThemeListener()
         {
             var currentUser = WindowsIdentity.GetCurrent();
+            var userSid = currentUser.User.Value;
+            var keyPath = $"{userSid}\\\\{ThemeHelpers.HkeyWindowsPersonalizeTheme.Replace("\\", "\\\\")}";
+            var valueName = ThemeHelpers.HValueAppTheme;
             var query = new WqlEventQuery(
-                $"SELECT * FROM RegistryValueChangeEvent WHERE Hive='HKEY_USERS' AND " +
-                $"KeyPath='{currentUser.User.Value}\\\\{ThemeHelpers.HkeyWindowsPersonalizeTheme.Replace("\\", "\\\\")}' AND ValueName='{ThemeHelpers.HValueAppTheme}'");
+                "SELECT * FROM RegistryValueChangeEvent WHERE Hive='HKEY_USERS' AND " +
+                "KeyPath=? AND ValueName=?",
+                new string[] { keyPath, valueName });
             watcher = new ManagementEventWatcher(query);
             watcher.EventArrived += Watcher_EventArrived;
             watcher.Start();

tools/CleanUp_tool/main.cpp

@@ -3,6 +3,7 @@
 #include <cstring>
 #include <shlwapi.h>
 #include <shlobj.h>
+#include <iostream>
 
 static wchar_t szWindowClass[] = L"CleanUp tool";
 static wchar_t szTitle[] = L"Tool to clean up FancyZones installation";
@@ -128,13 +129,15 @@ void RemoveSettingsFolder()
     HRESULT hr = CoInitializeEx(nullptr, COINIT_APARTMENTTHREADED | COINIT_DISABLE_OLE1DDE);
     if (FAILED(hr))
     {
+        std::wcerr << L"[AUDIT] CoInitializeEx failed: 0x" << std::hex << hr << std::endl;
         return;
     }
 
     IFileOperation* pfo;
     hr = CoCreateInstance(CLSID_FileOperation, nullptr, CLSCTX_ALL, IID_PPV_ARGS(&pfo));
     if (FAILED(hr))
-    {
+{
+        std::wcerr << L"[AUDIT] CoCreateInstance failed: 0x" << std::hex << hr << std::endl;
         return;
     }
 
@@ -148,13 +151,29 @@ void RemoveSettingsFolder()
             if (SUCCEEDED(hr))
             {
                 hr = pfo->DeleteItem(psiFrom, nullptr);
+                if (FAILED(hr))
+                {
+                    std::wcerr << L"[AUDIT] DeleteItem failed for path: " << settingsPath << L", error: 0x" << std::hex << hr << std::endl;
+                }
             }
             psiFrom->Release();
         }
+        else
+        {
+            std::wcerr << L"[AUDIT] SHCreateItemFromParsingName failed for path: " << settingsPath << L", error: 0x" << std::hex << hr << std::endl;
+        }
 
         if (SUCCEEDED(hr))
         {
             hr = pfo->PerformOperations();
+            if (SUCCEEDED(hr))
+            {
+                std::wcout << L"[AUDIT] Successfully deleted settings folder: " << settingsPath << std::endl;
+            }
+            else
+            {
+                std::wcerr << L"[AUDIT] PerformOperations failed: 0x" << std::hex << hr << std::endl;
+            }
         }
     }
     pfo->Release();

tools/MonitorReportTool/MonitorReportTool.cpp

@@ -294,7 +294,8 @@ void LogWMI()
             break;
         }
 
-        LogWMIProp(pClassObject, L"InstanceName");
+        // InstanceName contains sensitive device identification - redact it
+        Logger::log(L"InstanceName : [REDACTED]");
 
         LogWMIProp(pClassObject, L"YearOfManufacture");
         LogWMIProp(pClassObject, L"WeekOfManufacture");
@@ -303,8 +304,9 @@ void LogWMI()
         LogWMIProp(pClassObject, L"UserFriendlyName");
         LogWMIProp(pClassObject, L"ManufacturerName");
 
-        LogWMIProp(pClassObject, L"SerialNumberID");
-        LogWMIProp(pClassObject, L"ProductCodeID");
+        // Serial numbers and product codes are sensitive device identifiers - redact them
+        Logger::log(L"SerialNumberID : [REDACTED]");
+        Logger::log(L"ProductCodeID : [REDACTED]");
 
         Logger::log(L"");
 
@@ -414,13 +416,15 @@ void LogWMICIMV2()
             break;
         }
 
-        LogWMIProp(pClassObject, L"DeviceID");
+        // DeviceID and PNPDeviceID contain sensitive device identifiers - redact them
+        Logger::log(L"DeviceID : [REDACTED]");
         LogWMIProp(pClassObject, L"Caption");
         LogWMIProp(pClassObject, L"Description");
         LogWMIProp(pClassObject, L"MonitorManufacturer");
         LogWMIProp(pClassObject, L"MonitorType");
         LogWMIProp(pClassObject, L"Name");
-        LogWMIProp(pClassObject, L"PNPDeviceID");
+        // PNPDeviceID is sensitive device identification information - redact it
+        Logger::log(L"PNPDeviceID : [REDACTED]");
         LogWMIProp(pClassObject, L"Status");
 
         LogWMIProp(pClassObject, L"Availability");