a4b2c5bd1c
Security audit follow-up. No Critical/High existed; these close the
Medium/Low findings.
F1 [Med] Host privilege boundary: a host could demote a peer host to
guest and then ban / PIN-reset (→ account takeover via /recover) them,
because the ban/pin-reset peer guards key off the target's *current*
role. set_role now blocks a non-admin from demoting a host.
F2 [Med] Moderation now revokes preview/thumbnail access: they are served
through visibility-checked aliases (/api/v1/upload/{id}/{preview,
thumbnail}) that filter soft-deleted / ban-hidden uploads, and direct
/media/previews|thumbnails is 404-blocked. Feed emits the gated URLs;
Caddy keeps them privately cacheable (max-age=300, short so moderation
revokes promptly — the live feed already evicts cards via SSE). Uses a
lean find_visible_media() (paths+mime only) on the media hot path.
F3 [Med/Low] npm audit fix: svelte 5.55.1→5.56.4 (SSR-XSS advisories),
devalue 5.6.4→5.8.1 (DoS). Prod deps: 0 vulnerabilities.
F4 [Low] /recover no longer leaks account existence: unknown display name
returns the same 401 as a wrong PIN, and runs a dummy bcrypt verify so
timing matches — closing the enumeration + timing oracle.
F5 [Low] SSE streams re-validate the session every ~60s and close once it
is logged out / expired, instead of running until client disconnect.
F6 [Info] X-Content-Type-Options: nosniff set at the app layer on all
media responses (defense-in-depth alongside the edge).
Tests: new e2e specs for F1 (host cannot demote peer host), F2 (preview
gated + 404 after delete + direct /media blocked), F4 (uniform 401).
40 backend unit tests + 182 e2e passing.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
27 lines
1.3 KiB
TypeScript
27 lines
1.3 KiB
TypeScript
/**
|
|
* Security fix F4: /recover no longer leaks whether a display name exists. Previously an
|
|
* unknown name returned 404 ("Kein Benutzer …") while an existing name + wrong PIN
|
|
* returned 401 ("PIN ist falsch") — a response (and bcrypt-timing) oracle for account
|
|
* enumeration. Now both return an identical 401.
|
|
*/
|
|
import { test, expect } from '../../fixtures/test';
|
|
|
|
test.describe('Auth — recover does not leak account existence (F4)', () => {
|
|
test('unknown name and wrong PIN both return an identical 401', async ({ api, guest }) => {
|
|
// Establish the event + a real user first (a truncate wipes the event row; the join
|
|
// recreates it — otherwise recover 404s on "event not found" before name resolution).
|
|
const g = await guest('RealPerson');
|
|
|
|
// Unknown display name → 401 "PIN ist falsch" (NOT a 404 revealing non-existence).
|
|
const unknown = await api.recover('NoSuchPersonXYZ', '0000', { expectedStatus: [401] });
|
|
expect(unknown.status).toBe(401);
|
|
expect(JSON.stringify(unknown.body)).toContain('PIN');
|
|
|
|
// A real user with a wrong PIN returns the same 401 shape.
|
|
const wrongPin = g.pin === '0001' ? '0002' : '0001';
|
|
const wrong = await api.recover('RealPerson', wrongPin, { expectedStatus: [401] });
|
|
expect(wrong.status).toBe(401);
|
|
expect(JSON.stringify(wrong.body)).toContain('PIN');
|
|
});
|
|
});
|