dd25f073cd
Four high/medium findings from the audit, plus their tests: 1. **SSRF on admin-editable URLs.** `CrawlerSettings::start_url` and `AnalysisSettings::endpoint` validated only with `Url::parse`. A hostile or CSRF-able admin could repoint at `169.254.169.254` (cloud metadata), `127.0.0.1:5432` (postgres), or any RFC1918 host — and the vision worker bearer-attaches an env-managed API key to every call. Extract `ensure_public_target` from `safety::is_safe_url` (allowlist-free public-host check: scheme + private-IP literal + localhost) and wire it into both fields. Docker DNS names (`mangalord-vision`) keep passing because they're hostnames, not IP literals. The analysis check is gated on `enabled=true` so the dev-default `localhost:8000` stays usable until the worker is actually turned on (toggling enabled=true later re-runs the gate). 2. **Admin CSRF fail-open default.** `ADMIN_ALLOWED_ORIGINS=` empty silently skipped the entire CSRF check, so an operator forgetting the env var shipped an unguarded admin surface. Cookie-auth POSTs now fail-closed when the allowlist is empty AND when neither `Origin` nor `Referer` accompanies the request. Two carve-outs: `Authorization: Bearer …` callers bypass (bots can't be CSRF'd), and requests with NO session cookie at all bypass to let the auth extractor return a clean 401 instead of a confusing 403. 3. **Analysis HTTP clients didn't `.no_proxy()`.** The crawler client already did. Ambient `HTTP_PROXY`/`HTTPS_PROXY` in container env would exfiltrate page-image bytes + the bearer key through an upstream proxy. Same for the readiness probe. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
73 lines
2.3 KiB
TOML
73 lines
2.3 KiB
TOML
[package]
|
||
name = "mangalord"
|
||
version = "0.87.2"
|
||
edition = "2021"
|
||
default-run = "mangalord"
|
||
|
||
[lib]
|
||
path = "src/lib.rs"
|
||
|
||
[[bin]]
|
||
name = "mangalord"
|
||
path = "src/main.rs"
|
||
|
||
[[bin]]
|
||
name = "crawler"
|
||
path = "src/bin/crawler.rs"
|
||
|
||
[dependencies]
|
||
axum = { version = "0.7", features = ["macros", "multipart"] }
|
||
tokio = { version = "1", features = ["full"] }
|
||
sqlx = { version = "0.8", features = ["runtime-tokio", "postgres", "uuid", "chrono", "macros", "migrate"] }
|
||
serde = { version = "1", features = ["derive"] }
|
||
serde_json = "1"
|
||
uuid = { version = "1", features = ["v4", "serde"] }
|
||
chrono = { version = "0.4", features = ["serde"] }
|
||
chrono-tz = "0.9"
|
||
tracing = "0.1"
|
||
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
|
||
tower = { version = "0.5", features = ["util"] }
|
||
tower-http = { version = "0.6", features = ["trace", "cors"] }
|
||
thiserror = "1"
|
||
anyhow = "1"
|
||
async-trait = "0.1"
|
||
dotenvy = "0.15"
|
||
argon2 = "0.5"
|
||
rand = "0.8"
|
||
sha2 = "0.10"
|
||
subtle = "2"
|
||
base64 = "0.22"
|
||
# Image decode + downscale for the analysis worker (keep the page image
|
||
# under the local vision model's token budget). Only the manga page formats.
|
||
image = { version = "0.25", default-features = false, features = ["jpeg", "png", "webp"] }
|
||
axum-extra = { version = "0.9", features = ["cookie", "typed-header"] }
|
||
time = "0.3"
|
||
infer = "0.16"
|
||
tokio-util = { version = "0.7", features = ["io"] }
|
||
futures-core = "0.3"
|
||
futures-util = "0.3"
|
||
bytes = "1"
|
||
chromiumoxide = { version = "0.7", features = ["tokio-runtime", "_fetcher-rusttls-tokio"], default-features = false }
|
||
sysinfo = { version = "0.32", default-features = false, features = ["system", "component"] }
|
||
nix = { version = "0.29", features = ["fs"] }
|
||
scraper = "0.20"
|
||
reqwest = { version = "0.12", default-features = false, features = ["rustls-tls", "socks", "cookies", "stream", "json"] }
|
||
|
||
[dev-dependencies]
|
||
tempfile = "3"
|
||
tower = { version = "0.5", features = ["util"] }
|
||
http-body-util = "0.1"
|
||
mime = "0.3"
|
||
futures-util = "0.3"
|
||
tokio = { version = "1", features = ["test-util"] }
|
||
|
||
# Trim debug builds: keep line numbers in panics / backtraces but drop the
|
||
# full DWARF info (variable-level inspection in gdb/lldb). With a sqlx +
|
||
# axum + tokio dep tree the default ("full") leaves backend/target on the
|
||
# order of tens of GiB; this typically cuts ~50–70% off that.
|
||
[profile.dev]
|
||
debug = "line-tables-only"
|
||
|
||
[profile.test]
|
||
debug = "line-tables-only"
|