From c654a6d17eb58adbb15b9c47ab32bcc3a1666307 Mon Sep 17 00:00:00 2001
From: salmonik <salmonik@tuta.io>
Date: Wed, 29 Jul 2026 02:24:41 +0200
Subject: Security audit fixes: patch 16 vulnerabilities across 7 source files

CRITICAL:
- Instance name path traversal (AP-001): sanitize::sanitize_instance_name()
  strips .., /, \, \0, spaces, special chars at all 12 join call sites
- Zip-slip protection in world import: starts_with() guard after enclosed_name()

HIGH:
- RCON command injection: validate_username() rejects non-MC usernames
  across all 6 player action macros (whitelist, op, ban)
- Level-seed properties injection: sanitize_seed() strips \n \r = : \0
- CSRF protection: SameSite=Lax -> SameSite=Strict on session cookie

MEDIUM:
- Session TTL: server-side 24h expiry via strftime check in require_auth
- Rate limiting: in-memory 10-ip/5min sliding window on login
- Background task stale is_active: all queries use concrete WHERE id=?1
- Mod validation DoS: 500MB cap, 10k class scan limit, 10k CP entry cap

LOW:
- Logout auth guard: moved into protected route group + CurrentUser param
- Mod orphan race: DB insert before file write
- Backup orphan race: DB insert before ZIP creation
- Template fix: broken Askama == comparisons in edit.html

All fixes compile clean with zero warnings. 10 unit tests pass.
---
 piolium/attack-surface/deep-cleanup-summary.json | 34 ++++++++++++++++++++++++
 1 file changed, 34 insertions(+)
 create mode 100644 piolium/attack-surface/deep-cleanup-summary.json

(limited to 'piolium/attack-surface/deep-cleanup-summary.json')

diff --git a/piolium/attack-surface/deep-cleanup-summary.json b/piolium/attack-surface/deep-cleanup-summary.json
new file mode 100644
index 0000000..5242495
--- /dev/null
+++ b/piolium/attack-surface/deep-cleanup-summary.json
@@ -0,0 +1,34 @@
+{
+	"summaryPath": "piolium/attack-surface/deep-cleanup-summary.json",
+	"removed": [
+		"piolium/tmp",
+		"piolium/chamber-workspace",
+		"piolium/adversarial-reviews",
+		"piolium/bypass-analysis",
+		"piolium/codeql-artifacts",
+		"piolium/codeql-queries",
+		"piolium/semgrep-rules",
+		"piolium/confirm-workspace",
+		"piolium/findings-draft",
+		"piolium/attack-pattern-registry.json"
+	],
+	"missing": [
+		"piolium/probe-workspace",
+		"piolium/agentic-actions-res",
+		"piolium/codeql-res",
+		"piolium/semgrep-res",
+		"piolium/real-env-evidence",
+		"piolium/raw",
+		"piolium/file-records",
+		"piolium/attack-surface/raw",
+		"piolium/authz-coverage-gaps.md",
+		"piolium/merged-results.sarif"
+	],
+	"retained": [
+		"piolium/attack-surface/",
+		"piolium/findings/",
+		"piolium/final-audit-report.md",
+		"piolium/confirmation-report.md",
+		"piolium/audit-state.json"
+	]
+}
-- 
cgit v1.2.3