From c654a6d17eb58adbb15b9c47ab32bcc3a1666307 Mon Sep 17 00:00:00 2001
From: salmonik <salmonik@tuta.io>
Date: Wed, 29 Jul 2026 02:24:41 +0200
Subject: Security audit fixes: patch 16 vulnerabilities across 7 source files

CRITICAL:
- Instance name path traversal (AP-001): sanitize::sanitize_instance_name()
  strips .., /, \, \0, spaces, special chars at all 12 join call sites
- Zip-slip protection in world import: starts_with() guard after enclosed_name()

HIGH:
- RCON command injection: validate_username() rejects non-MC usernames
  across all 6 player action macros (whitelist, op, ban)
- Level-seed properties injection: sanitize_seed() strips \n \r = : \0
- CSRF protection: SameSite=Lax -> SameSite=Strict on session cookie

MEDIUM:
- Session TTL: server-side 24h expiry via strftime check in require_auth
- Rate limiting: in-memory 10-ip/5min sliding window on login
- Background task stale is_active: all queries use concrete WHERE id=?1
- Mod validation DoS: 500MB cap, 10k class scan limit, 10k CP entry cap

LOW:
- Logout auth guard: moved into protected route group + CurrentUser param
- Mod orphan race: DB insert before file write
- Backup orphan race: DB insert before ZIP creation
- Template fix: broken Askama == comparisons in edit.html

All fixes compile clean with zero warnings. 10 unit tests pass.
---
 piolium/audit-state.json | 128 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 128 insertions(+)
 create mode 100644 piolium/audit-state.json

(limited to 'piolium/audit-state.json')

diff --git a/piolium/audit-state.json b/piolium/audit-state.json
new file mode 100644
index 0000000..a3189ba
--- /dev/null
+++ b/piolium/audit-state.json
@@ -0,0 +1,128 @@
+{
+	"audits": [
+		{
+			"audit_id": "2026-07-28T23:03:56.306Z",
+			"mode": "deep",
+			"started_at": "2026-07-28T23:03:56.306Z",
+			"completed_at": "2026-07-28T23:56:39.168Z",
+			"status": "complete",
+			"phases": {
+				"P1": {
+					"status": "complete",
+					"attempt": 1,
+					"max_attempts": 6,
+					"started_at": "2026-07-28T23:03:56.339Z",
+					"completed_at": "2026-07-28T23:06:10.169Z"
+				},
+				"P2": {
+					"status": "complete",
+					"attempt": 1,
+					"max_attempts": 6,
+					"started_at": "2026-07-28T23:06:10.172Z",
+					"completed_at": "2026-07-28T23:08:39.158Z"
+				},
+				"P3": {
+					"status": "complete",
+					"attempt": 1,
+					"max_attempts": 6,
+					"started_at": "2026-07-28T23:08:39.163Z",
+					"completed_at": "2026-07-28T23:09:50.321Z"
+				},
+				"P4": {
+					"status": "complete",
+					"attempt": 1,
+					"max_attempts": 6,
+					"started_at": "2026-07-28T23:09:50.322Z",
+					"completed_at": "2026-07-28T23:15:54.779Z"
+				},
+				"P5": {
+					"status": "complete",
+					"attempt": 1,
+					"max_attempts": 6,
+					"started_at": "2026-07-28T23:15:54.785Z",
+					"completed_at": "2026-07-28T23:19:02.299Z"
+				},
+				"P6": {
+					"status": "complete",
+					"attempt": 1,
+					"max_attempts": 6,
+					"started_at": "2026-07-29T00:00:00.000Z",
+					"completed_at": "2026-07-28T23:33:30.924Z"
+				},
+				"P7": {
+					"status": "complete",
+					"attempt": 2,
+					"max_attempts": 6,
+					"started_at": "2026-07-28T23:15:54.842Z",
+					"completed_at": "2026-07-28T23:18:53.050Z"
+				},
+				"P8": {
+					"status": "complete",
+					"attempt": 1,
+					"max_attempts": 6,
+					"started_at": "2026-07-28T23:33:30.925Z",
+					"completed_at": "2026-07-28T23:37:29.143Z"
+				},
+				"P9": {
+					"status": "complete",
+					"attempt": 1,
+					"max_attempts": 6,
+					"started_at": "2026-07-28T23:37:29.144Z",
+					"completed_at": "2026-07-28T23:37:43.969Z"
+				},
+				"P10": {
+					"status": "complete",
+					"attempt": 1,
+					"max_attempts": 6,
+					"started_at": "2026-07-28T23:37:43.971Z",
+					"completed_at": "2026-07-28T23:47:24.464Z"
+				},
+				"P11": {
+					"status": "complete",
+					"attempt": 1,
+					"max_attempts": 6,
+					"started_at": "2026-07-28T23:47:24.475Z",
+					"completed_at": "2026-07-28T23:53:33.336Z"
+				},
+				"P12": {
+					"status": "complete",
+					"attempt": 1,
+					"max_attempts": 6,
+					"started_at": "2026-07-28T23:53:33.338Z",
+					"completed_at": "2026-07-28T23:55:30.920Z"
+				},
+				"P13": {
+					"status": "skipped",
+					"started_at": "2026-07-28T23:55:30.923Z",
+					"completed_at": "2026-07-28T23:55:30.931Z"
+				},
+				"P14": {
+					"status": "skipped",
+					"started_at": "2026-07-28T23:55:30.931Z",
+					"completed_at": "2026-07-28T23:55:30.932Z"
+				},
+				"P15": {
+					"status": "complete",
+					"attempt": 1,
+					"max_attempts": 6,
+					"started_at": "2026-07-28T23:55:30.933Z",
+					"completed_at": "2026-07-28T23:56:39.152Z"
+				},
+				"P16": {
+					"status": "complete",
+					"started_at": "2026-07-28T23:56:39.153Z",
+					"completed_at": "2026-07-28T23:56:39.155Z"
+				},
+				"P17": {
+					"status": "complete",
+					"started_at": "2026-07-28T23:56:39.155Z",
+					"completed_at": "2026-07-28T23:56:39.168Z"
+				}
+			},
+			"agent_sdk": "pi",
+			"commit": "74d2ada067bd2fd9436710ab7ac260e0eddf1314",
+			"branch": "master",
+			"history_available": true
+		}
+	]
+}
-- 
cgit v1.2.3