a4b2c5bd1c
Security audit follow-up. No Critical/High existed; these close the
Medium/Low findings.
F1 [Med] Host privilege boundary: a host could demote a peer host to
guest and then ban / PIN-reset (→ account takeover via /recover) them,
because the ban/pin-reset peer guards key off the target's *current*
role. set_role now blocks a non-admin from demoting a host.
F2 [Med] Moderation now revokes preview/thumbnail access: they are served
through visibility-checked aliases (/api/v1/upload/{id}/{preview,
thumbnail}) that filter soft-deleted / ban-hidden uploads, and direct
/media/previews|thumbnails is 404-blocked. Feed emits the gated URLs;
Caddy keeps them privately cacheable (max-age=300, short so moderation
revokes promptly — the live feed already evicts cards via SSE). Uses a
lean find_visible_media() (paths+mime only) on the media hot path.
F3 [Med/Low] npm audit fix: svelte 5.55.1→5.56.4 (SSR-XSS advisories),
devalue 5.6.4→5.8.1 (DoS). Prod deps: 0 vulnerabilities.
F4 [Low] /recover no longer leaks account existence: unknown display name
returns the same 401 as a wrong PIN, and runs a dummy bcrypt verify so
timing matches — closing the enumeration + timing oracle.
F5 [Low] SSE streams re-validate the session every ~60s and close once it
is logged out / expired, instead of running until client disconnect.
F6 [Info] X-Content-Type-Options: nosniff set at the app layer on all
media responses (defense-in-depth alongside the edge).
Tests: new e2e specs for F1 (host cannot demote peer host), F2 (preview
gated + 404 after delete + direct /media blocked), F4 (uniform 401).
40 backend unit tests + 182 e2e passing.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
60 lines
2.5 KiB
TypeScript
60 lines
2.5 KiB
TypeScript
/**
|
|
* Security fix F2: preview/thumbnail images are now served through a visibility-checked
|
|
* alias (/api/v1/upload/{id}/preview) instead of the unauthenticated /media ServeDir,
|
|
* so moderation (delete / ban-hide) actually revokes access to the displayed image —
|
|
* not just the full-res original. Direct /media/previews access is blocked.
|
|
*/
|
|
import { test, expect } from '../../fixtures/test';
|
|
import { seedUpload } from '../../helpers/seed';
|
|
|
|
const BASE = process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101';
|
|
|
|
test.describe('Media gating — moderation revokes preview access (F2)', () => {
|
|
test('preview served via gated alias, blocked directly, and 404 after delete', async ({
|
|
host,
|
|
api,
|
|
}) => {
|
|
test.setTimeout(30_000);
|
|
const id = await seedUpload(host.jwt, { caption: 'gated' });
|
|
|
|
// Wait for the compression worker to produce the preview — the feed exposes
|
|
// `preview_url` only once `preview_path` is set.
|
|
let previewUrl: string | undefined;
|
|
await expect
|
|
.poll(
|
|
async () => {
|
|
const feed = await api.getFeed(host.jwt);
|
|
const row = (feed.uploads ?? []).find((u: any) => u.id === id);
|
|
previewUrl = row?.preview_url ?? undefined;
|
|
return previewUrl;
|
|
},
|
|
{ timeout: 20_000, intervals: [500] }
|
|
)
|
|
.toBeTruthy();
|
|
|
|
// Feed now emits the gated alias, not a /media path.
|
|
expect(previewUrl).toBe(`/api/v1/upload/${id}/preview`);
|
|
|
|
// The gated alias serves the image with the app-layer nosniff header.
|
|
const ok = await fetch(`${BASE}${previewUrl}`);
|
|
expect(ok.status).toBe(200);
|
|
expect(ok.headers.get('content-type')).toContain('image/jpeg');
|
|
// App sets nosniff (F6); the edge proxy may also set it → value can be doubled.
|
|
expect(ok.headers.get('x-content-type-options')).toContain('nosniff');
|
|
|
|
// Direct /media access is blocked (404) — the alias is the only way in.
|
|
const direct = await fetch(`${BASE}/media/previews/${id}.jpg`);
|
|
expect(direct.status, 'direct /media/previews must be blocked').toBe(404);
|
|
|
|
// Host deletes the upload → the preview must stop being served.
|
|
const del = await fetch(`${BASE}/api/v1/host/upload/${id}`, {
|
|
method: 'DELETE',
|
|
headers: { Authorization: `Bearer ${host.jwt}` },
|
|
});
|
|
expect(del.status).toBe(204);
|
|
|
|
const afterDelete = await fetch(`${BASE}/api/v1/upload/${id}/preview`);
|
|
expect(afterDelete.status, 'moderation must revoke preview access').toBe(404);
|
|
});
|
|
});
|