a4b2c5bd1c
Security audit follow-up. No Critical/High existed; these close the
Medium/Low findings.
F1 [Med] Host privilege boundary: a host could demote a peer host to
guest and then ban / PIN-reset (→ account takeover via /recover) them,
because the ban/pin-reset peer guards key off the target's *current*
role. set_role now blocks a non-admin from demoting a host.
F2 [Med] Moderation now revokes preview/thumbnail access: they are served
through visibility-checked aliases (/api/v1/upload/{id}/{preview,
thumbnail}) that filter soft-deleted / ban-hidden uploads, and direct
/media/previews|thumbnails is 404-blocked. Feed emits the gated URLs;
Caddy keeps them privately cacheable (max-age=300, short so moderation
revokes promptly — the live feed already evicts cards via SSE). Uses a
lean find_visible_media() (paths+mime only) on the media hot path.
F3 [Med/Low] npm audit fix: svelte 5.55.1→5.56.4 (SSR-XSS advisories),
devalue 5.6.4→5.8.1 (DoS). Prod deps: 0 vulnerabilities.
F4 [Low] /recover no longer leaks account existence: unknown display name
returns the same 401 as a wrong PIN, and runs a dummy bcrypt verify so
timing matches — closing the enumeration + timing oracle.
F5 [Low] SSE streams re-validate the session every ~60s and close once it
is logged out / expired, instead of running until client disconnect.
F6 [Info] X-Content-Type-Options: nosniff set at the app layer on all
media responses (defense-in-depth alongside the edge).
Tests: new e2e specs for F1 (host cannot demote peer host), F2 (preview
gated + 404 after delete + direct /media blocked), F4 (uniform 401).
40 backend unit tests + 182 e2e passing.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
46 lines
1.8 KiB
TypeScript
46 lines
1.8 KiB
TypeScript
/**
|
|
* Security fix F1: a plain host must not be able to demote a *peer host*. Before the
|
|
* fix, `set_role` only blocked `target == admin`, so a host could demote another host
|
|
* to guest and then ban / PIN-reset (→ account takeover via /recover) them, because the
|
|
* ban/pin-reset peer guards key off the target's *current* role. This proves the
|
|
* demotion itself is now blocked for non-admins, while admins and guest-management
|
|
* still work.
|
|
*/
|
|
import { test, expect } from '../../fixtures/test';
|
|
|
|
const BASE = process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101';
|
|
|
|
function patchRole(token: string, userId: string, role: string) {
|
|
return fetch(`${BASE}/api/v1/host/users/${userId}/role`, {
|
|
method: 'PATCH',
|
|
headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
|
|
body: JSON.stringify({ role }),
|
|
});
|
|
}
|
|
|
|
test.describe('AuthZ — host cannot demote a peer host (F1)', () => {
|
|
test('host→host demotion is 403; admin may demote; host may still manage guests', async ({
|
|
host,
|
|
guest,
|
|
adminToken,
|
|
api,
|
|
}) => {
|
|
// A second host (the victim) and an ordinary guest.
|
|
const peer = await guest('PeerHost');
|
|
await api.setRole(adminToken, peer.userId, 'host');
|
|
const plain = await guest('PlainGuest');
|
|
|
|
// Attacker host tries to demote the peer host — must be refused.
|
|
const attack = await patchRole(host.jwt, peer.userId, 'guest');
|
|
expect(attack.status, 'a host must not be able to demote a peer host').toBe(403);
|
|
|
|
// An admin may still demote a host.
|
|
const byAdmin = await patchRole(adminToken, peer.userId, 'guest');
|
|
expect(byAdmin.status).toBe(204);
|
|
|
|
// A host may still manage guests (promote one to host).
|
|
const promote = await patchRole(host.jwt, plain.userId, 'host');
|
|
expect(promote.status).toBe(204);
|
|
});
|
|
});
|