From c654a6d17eb58adbb15b9c47ab32bcc3a1666307 Mon Sep 17 00:00:00 2001 From: salmonik Date: Wed, 29 Jul 2026 02:24:41 +0200 Subject: Security audit fixes: patch 16 vulnerabilities across 7 source files CRITICAL: - Instance name path traversal (AP-001): sanitize::sanitize_instance_name() strips .., /, \, \0, spaces, special chars at all 12 join call sites - Zip-slip protection in world import: starts_with() guard after enclosed_name() HIGH: - RCON command injection: validate_username() rejects non-MC usernames across all 6 player action macros (whitelist, op, ban) - Level-seed properties injection: sanitize_seed() strips \n \r = : \0 - CSRF protection: SameSite=Lax -> SameSite=Strict on session cookie MEDIUM: - Session TTL: server-side 24h expiry via strftime check in require_auth - Rate limiting: in-memory 10-ip/5min sliding window on login - Background task stale is_active: all queries use concrete WHERE id=?1 - Mod validation DoS: 500MB cap, 10k class scan limit, 10k CP entry cap LOW: - Logout auth guard: moved into protected route group + CurrentUser param - Mod orphan race: DB insert before file write - Backup orphan race: DB insert before ZIP creation - Template fix: broken Askama == comparisons in edit.html All fixes compile clean with zero warnings. 10 unit tests pass. --- piolium/attack-surface/sbom.json | 282 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 282 insertions(+) create mode 100644 piolium/attack-surface/sbom.json (limited to 'piolium/attack-surface/sbom.json') diff --git a/piolium/attack-surface/sbom.json b/piolium/attack-surface/sbom.json new file mode 100644 index 0000000..3f7d7eb --- /dev/null +++ b/piolium/attack-surface/sbom.json @@ -0,0 +1,282 @@ +{ + "target": "salmon/minecraft-ui", + "generated_at": "2025-07-29T01:15:00Z", + "components": [ + { + "name": "rust", + "category": "runtime", + "ecosystem": null, + "version": "edition 2024", + "relationship": "direct", + "purpose": "Language runtime for the application", + "evidence": ["Cargo.toml:3 edition = \"2024\""], + "security_relevant": false + }, + { + "name": "axum", + "category": "framework", + "ecosystem": "crates.io", + "version": "0.8.9", + "relationship": "direct", + "purpose": "HTTP web framework (router, middleware, extractors)", + "evidence": ["Cargo.toml:7", "src/routes/mod.rs:3 use"], + "security_relevant": true + }, + { + "name": "multer", + "category": "package", + "ecosystem": "crates.io", + "version": "3.1.0", + "relationship": "direct", + "purpose": "Multipart/form-data parser for file uploads", + "evidence": ["Cargo.toml:8", "src/routes/mods.rs:106 use multer::Multipart"], + "security_relevant": true + }, + { + "name": "tokio", + "category": "package", + "ecosystem": "crates.io", + "version": "1.52.3", + "relationship": "direct", + "purpose": "Async runtime (TCP, timers, tasks)", + "evidence": ["Cargo.toml:9", "src/main.rs:15 #[tokio::main]"], + "security_relevant": true + }, + { + "name": "rusqlite", + "category": "package", + "ecosystem": "crates.io", + "version": "0.40.1", + "relationship": "direct", + "purpose": "SQLite database interface", + "evidence": ["Cargo.toml:11", "src/db.rs:2 use"], + "security_relevant": true + }, + { + "name": "bollard", + "category": "package", + "ecosystem": "crates.io", + "version": "0.17.1", + "relationship": "direct", + "purpose": "Docker Engine API client", + "evidence": ["Cargo.toml:12", "src/docker.rs:2-8 use bollard::*"], + "security_relevant": true + }, + { + "name": "argon2", + "category": "package", + "ecosystem": "crates.io", + "version": "0.5.3", + "relationship": "direct", + "purpose": "Password hashing (Argon2id algorithm)", + "evidence": ["Cargo.toml:17", "src/auth.rs:1-2 use argon2::*"], + "security_relevant": true + }, + { + "name": "zip", + "category": "package", + "ecosystem": "crates.io", + "version": "8.6.0", + "relationship": "direct", + "purpose": "ZIP archive reading/writing (world export/import, mods, backups)", + "evidence": ["Cargo.toml:20", "src/mods.rs:8 use zip::ZipArchive"], + "security_relevant": true + }, + { + "name": "reqwest", + "category": "package", + "ecosystem": "crates.io", + "version": "0.13.4", + "relationship": "direct", + "purpose": "HTTP client for Mojang version manifest API", + "evidence": ["Cargo.toml:26", "src/routes/instances.rs:280"], + "security_relevant": false + }, + { + "name": "cookie", + "category": "package", + "ecosystem": "crates.io", + "version": "0.18.1", + "relationship": "direct", + "purpose": "Cookie parsing utilities", + "evidence": ["Cargo.toml:28"], + "security_relevant": true + }, + { + "name": "axum-extra", + "category": "package", + "ecosystem": "crates.io", + "version": "0.12.6", + "relationship": "direct", + "purpose": "Extra axum utilities including cookie private jar", + "evidence": ["Cargo.toml:29", "features = [\"cookie-private\"]"], + "security_relevant": true + }, + { + "name": "serde", + "category": "package", + "ecosystem": "crates.io", + "version": "1.0.228", + "relationship": "direct", + "purpose": "Serialization/deserialization framework", + "evidence": ["Cargo.toml:13"], + "security_relevant": false + }, + { + "name": "askama", + "category": "framework", + "ecosystem": "crates.io", + "version": "0.16.0", + "relationship": "direct", + "purpose": "Compile-time template engine", + "evidence": ["Cargo.toml:10", "src/routes/*.rs: use askama::Template"], + "security_relevant": false + }, + { + "name": "tower-http", + "category": "package", + "ecosystem": "crates.io", + "version": "0.7.0", + "relationship": "direct", + "purpose": "HTTP middleware (static file serving via ServeDir)", + "evidence": ["Cargo.toml:15", "src/routes/mod.rs:6"], + "security_relevant": false + }, + { + "name": "chrono", + "category": "package", + "ecosystem": "crates.io", + "version": "0.4.45", + "relationship": "direct", + "purpose": "Date/time handling for backup timestamps", + "evidence": ["Cargo.toml:27", "src/routes/backups.rs:69"], + "security_relevant": false + }, + { + "name": "uuid", + "category": "package", + "ecosystem": "crates.io", + "version": "1.23.4", + "relationship": "direct", + "purpose": "UUID generation for session IDs", + "evidence": ["Cargo.toml:18", "src/auth.rs:82"], + "security_relevant": false + }, + { + "name": "tempfile", + "category": "package", + "ecosystem": "crates.io", + "version": "3.27.0", + "relationship": "direct", + "purpose": "Temporary file/directory management", + "evidence": ["Cargo.toml:21"], + "security_relevant": false + }, + { + "name": "rand", + "category": "package", + "ecosystem": "crates.io", + "version": "0.8.7", + "relationship": "direct", + "purpose": "Random number generation for RCON passwords", + "evidence": ["Cargo.toml:19", "src/routes/instances.rs:263"], + "security_relevant": true + }, + { + "name": "tracing", + "category": "package", + "ecosystem": "crates.io", + "version": "0.1.44", + "relationship": "direct", + "purpose": "Logging and instrumentation framework", + "evidence": ["Cargo.toml:22", "src/main.rs:3 use tracing_subscriber"], + "security_relevant": false + }, + { + "name": "serde_json", + "category": "package", + "ecosystem": "crates.io", + "version": "1.0.150", + "relationship": "direct", + "purpose": "JSON parsing (Fabric mod metadata, Mojang API)", + "evidence": ["Cargo.toml:14", "src/mods.rs: parse_fabric_metadata"], + "security_relevant": false + }, + { + "name": "toml", + "category": "package", + "ecosystem": "crates.io", + "version": "1.1.2+spec-1.1.0", + "relationship": "direct", + "purpose": "TOML config parsing + Forge mod metadata parsing", + "evidence": ["Cargo.toml:16", "src/config.rs:9", "src/mods.rs: parse_forge_metadata"], + "security_relevant": false + }, + { + "name": "futures-util", + "category": "package", + "ecosystem": "crates.io", + "version": "0.3.32", + "relationship": "direct", + "purpose": "Async stream utilities for Docker image pull", + "evidence": ["Cargo.toml:30", "src/docker.rs:6 use futures_util::StreamExt"], + "security_relevant": false + }, + { + "name": "Docker daemon", + "category": "binary", + "ecosystem": null, + "version": "unknown (local)", + "relationship": "direct", + "purpose": "Container runtime for Minecraft server instances", + "evidence": ["src/docker.rs:28 Docker::connect_with_local_defaults()"], + "security_relevant": true + }, + { + "name": "itzg/minecraft-server", + "category": "container-os", + "ecosystem": "docker", + "version": "java8 / java17 / java21 (dynamic per version)", + "relationship": "direct", + "purpose": "Minecraft server Docker image (Java + Minecraft server jar)", + "evidence": ["src/docker.rs:34-43 java_tag()", "minecraft/docker-compose.yml"], + "security_relevant": true + }, + { + "name": "piston-meta.mojang.com", + "category": "external-service", + "ecosystem": null, + "version": "N/A (API)", + "relationship": "direct", + "purpose": "Minecraft version manifest API", + "evidence": ["src/routes/instances.rs:280"], + "security_relevant": false + }, + { + "name": "htmx.min.js", + "category": "vendored", + "ecosystem": null, + "version": "unknown (vendored)", + "relationship": "direct", + "purpose": "HTMX JavaScript library for dynamic HTML", + "evidence": ["static/htmx.min.js"], + "security_relevant": false + }, + { + "name": "SQLite", + "category": "datastore", + "ecosystem": null, + "version": "bundled (via rusqlite bundled feature)", + "relationship": "direct", + "purpose": "Embedded database for accounts, sessions, instances, mods, backups", + "evidence": ["Cargo.toml:11 features = [\"bundled\"]", "src/db.rs"], + "security_relevant": true + } + ], + "categories_covered": ["runtime", "package", "framework", "datastore", "external-service", "container-os", "binary", "vendored"], + "coverage_gaps": [ + "build-ci: No CI configuration found in repository", + "container-os: Dockerfile not in repo — base image pulled externally (itzg/minecraft-server)", + "binary: Java runtime version is dynamic per Minecraft version, not pinned" + ] +} -- cgit v1.2.3