diff options
| author | salmonik <salmonik@tuta.io> | 2026-07-29 02:24:41 +0200 |
|---|---|---|
| committer | salmonik <salmonik@tuta.io> | 2026-07-29 02:24:41 +0200 |
| commit | c654a6d17eb58adbb15b9c47ab32bcc3a1666307 (patch) | |
| tree | 545544bf7d805254415da787fad1cdc711767833 /piolium/audit-state.json | |
| parent | Add per-instance mod management with client-side detection (diff) | |
| download | minecraft-ui-c654a6d17eb58adbb15b9c47ab32bcc3a1666307.tar.gz minecraft-ui-c654a6d17eb58adbb15b9c47ab32bcc3a1666307.zip | |
Security audit fixes: patch 16 vulnerabilities across 7 source files
CRITICAL:
- Instance name path traversal (AP-001): sanitize::sanitize_instance_name()
strips .., /, \, \0, spaces, special chars at all 12 join call sites
- Zip-slip protection in world import: starts_with() guard after enclosed_name()
HIGH:
- RCON command injection: validate_username() rejects non-MC usernames
across all 6 player action macros (whitelist, op, ban)
- Level-seed properties injection: sanitize_seed() strips \n \r = : \0
- CSRF protection: SameSite=Lax -> SameSite=Strict on session cookie
MEDIUM:
- Session TTL: server-side 24h expiry via strftime check in require_auth
- Rate limiting: in-memory 10-ip/5min sliding window on login
- Background task stale is_active: all queries use concrete WHERE id=?1
- Mod validation DoS: 500MB cap, 10k class scan limit, 10k CP entry cap
LOW:
- Logout auth guard: moved into protected route group + CurrentUser param
- Mod orphan race: DB insert before file write
- Backup orphan race: DB insert before ZIP creation
- Template fix: broken Askama == comparisons in edit.html
All fixes compile clean with zero warnings. 10 unit tests pass.
Diffstat (limited to '')
| -rw-r--r-- | piolium/audit-state.json | 128 |
1 files changed, 128 insertions, 0 deletions
diff --git a/piolium/audit-state.json b/piolium/audit-state.json new file mode 100644 index 0000000..a3189ba --- /dev/null +++ b/piolium/audit-state.json | |||
| @@ -0,0 +1,128 @@ | |||
| 1 | { | ||
| 2 | "audits": [ | ||
| 3 | { | ||
| 4 | "audit_id": "2026-07-28T23:03:56.306Z", | ||
| 5 | "mode": "deep", | ||
| 6 | "started_at": "2026-07-28T23:03:56.306Z", | ||
| 7 | "completed_at": "2026-07-28T23:56:39.168Z", | ||
| 8 | "status": "complete", | ||
| 9 | "phases": { | ||
| 10 | "P1": { | ||
| 11 | "status": "complete", | ||
| 12 | "attempt": 1, | ||
| 13 | "max_attempts": 6, | ||
| 14 | "started_at": "2026-07-28T23:03:56.339Z", | ||
| 15 | "completed_at": "2026-07-28T23:06:10.169Z" | ||
| 16 | }, | ||
| 17 | "P2": { | ||
| 18 | "status": "complete", | ||
| 19 | "attempt": 1, | ||
| 20 | "max_attempts": 6, | ||
| 21 | "started_at": "2026-07-28T23:06:10.172Z", | ||
| 22 | "completed_at": "2026-07-28T23:08:39.158Z" | ||
| 23 | }, | ||
| 24 | "P3": { | ||
| 25 | "status": "complete", | ||
| 26 | "attempt": 1, | ||
| 27 | "max_attempts": 6, | ||
| 28 | "started_at": "2026-07-28T23:08:39.163Z", | ||
| 29 | "completed_at": "2026-07-28T23:09:50.321Z" | ||
| 30 | }, | ||
| 31 | "P4": { | ||
| 32 | "status": "complete", | ||
| 33 | "attempt": 1, | ||
| 34 | "max_attempts": 6, | ||
| 35 | "started_at": "2026-07-28T23:09:50.322Z", | ||
| 36 | "completed_at": "2026-07-28T23:15:54.779Z" | ||
| 37 | }, | ||
| 38 | "P5": { | ||
| 39 | "status": "complete", | ||
| 40 | "attempt": 1, | ||
| 41 | "max_attempts": 6, | ||
| 42 | "started_at": "2026-07-28T23:15:54.785Z", | ||
| 43 | "completed_at": "2026-07-28T23:19:02.299Z" | ||
| 44 | }, | ||
| 45 | "P6": { | ||
| 46 | "status": "complete", | ||
| 47 | "attempt": 1, | ||
| 48 | "max_attempts": 6, | ||
| 49 | "started_at": "2026-07-29T00:00:00.000Z", | ||
| 50 | "completed_at": "2026-07-28T23:33:30.924Z" | ||
| 51 | }, | ||
| 52 | "P7": { | ||
| 53 | "status": "complete", | ||
| 54 | "attempt": 2, | ||
| 55 | "max_attempts": 6, | ||
| 56 | "started_at": "2026-07-28T23:15:54.842Z", | ||
| 57 | "completed_at": "2026-07-28T23:18:53.050Z" | ||
| 58 | }, | ||
| 59 | "P8": { | ||
| 60 | "status": "complete", | ||
| 61 | "attempt": 1, | ||
| 62 | "max_attempts": 6, | ||
| 63 | "started_at": "2026-07-28T23:33:30.925Z", | ||
| 64 | "completed_at": "2026-07-28T23:37:29.143Z" | ||
| 65 | }, | ||
| 66 | "P9": { | ||
| 67 | "status": "complete", | ||
| 68 | "attempt": 1, | ||
| 69 | "max_attempts": 6, | ||
| 70 | "started_at": "2026-07-28T23:37:29.144Z", | ||
| 71 | "completed_at": "2026-07-28T23:37:43.969Z" | ||
| 72 | }, | ||
| 73 | "P10": { | ||
| 74 | "status": "complete", | ||
| 75 | "attempt": 1, | ||
| 76 | "max_attempts": 6, | ||
| 77 | "started_at": "2026-07-28T23:37:43.971Z", | ||
| 78 | "completed_at": "2026-07-28T23:47:24.464Z" | ||
| 79 | }, | ||
| 80 | "P11": { | ||
| 81 | "status": "complete", | ||
| 82 | "attempt": 1, | ||
| 83 | "max_attempts": 6, | ||
| 84 | "started_at": "2026-07-28T23:47:24.475Z", | ||
| 85 | "completed_at": "2026-07-28T23:53:33.336Z" | ||
| 86 | }, | ||
| 87 | "P12": { | ||
| 88 | "status": "complete", | ||
| 89 | "attempt": 1, | ||
| 90 | "max_attempts": 6, | ||
| 91 | "started_at": "2026-07-28T23:53:33.338Z", | ||
| 92 | "completed_at": "2026-07-28T23:55:30.920Z" | ||
| 93 | }, | ||
| 94 | "P13": { | ||
| 95 | "status": "skipped", | ||
| 96 | "started_at": "2026-07-28T23:55:30.923Z", | ||
| 97 | "completed_at": "2026-07-28T23:55:30.931Z" | ||
| 98 | }, | ||
| 99 | "P14": { | ||
| 100 | "status": "skipped", | ||
| 101 | "started_at": "2026-07-28T23:55:30.931Z", | ||
| 102 | "completed_at": "2026-07-28T23:55:30.932Z" | ||
| 103 | }, | ||
| 104 | "P15": { | ||
| 105 | "status": "complete", | ||
| 106 | "attempt": 1, | ||
| 107 | "max_attempts": 6, | ||
| 108 | "started_at": "2026-07-28T23:55:30.933Z", | ||
| 109 | "completed_at": "2026-07-28T23:56:39.152Z" | ||
| 110 | }, | ||
| 111 | "P16": { | ||
| 112 | "status": "complete", | ||
| 113 | "started_at": "2026-07-28T23:56:39.153Z", | ||
| 114 | "completed_at": "2026-07-28T23:56:39.155Z" | ||
| 115 | }, | ||
| 116 | "P17": { | ||
| 117 | "status": "complete", | ||
| 118 | "started_at": "2026-07-28T23:56:39.155Z", | ||
| 119 | "completed_at": "2026-07-28T23:56:39.168Z" | ||
| 120 | } | ||
| 121 | }, | ||
| 122 | "agent_sdk": "pi", | ||
| 123 | "commit": "74d2ada067bd2fd9436710ab7ac260e0eddf1314", | ||
| 124 | "branch": "master", | ||
| 125 | "history_available": true | ||
| 126 | } | ||
| 127 | ] | ||
| 128 | } | ||