From c654a6d17eb58adbb15b9c47ab32bcc3a1666307 Mon Sep 17 00:00:00 2001 From: salmonik Date: Wed, 29 Jul 2026 02:24:41 +0200 Subject: Security audit fixes: patch 16 vulnerabilities across 7 source files CRITICAL: - Instance name path traversal (AP-001): sanitize::sanitize_instance_name() strips .., /, \, \0, spaces, special chars at all 12 join call sites - Zip-slip protection in world import: starts_with() guard after enclosed_name() HIGH: - RCON command injection: validate_username() rejects non-MC usernames across all 6 player action macros (whitelist, op, ban) - Level-seed properties injection: sanitize_seed() strips \n \r = : \0 - CSRF protection: SameSite=Lax -> SameSite=Strict on session cookie MEDIUM: - Session TTL: server-side 24h expiry via strftime check in require_auth - Rate limiting: in-memory 10-ip/5min sliding window on login - Background task stale is_active: all queries use concrete WHERE id=?1 - Mod validation DoS: 500MB cap, 10k class scan limit, 10k CP entry cap LOW: - Logout auth guard: moved into protected route group + CurrentUser param - Mod orphan race: DB insert before file write - Backup orphan race: DB insert before ZIP creation - Template fix: broken Askama == comparisons in edit.html All fixes compile clean with zero warnings. 10 unit tests pass. --- src/routes/mod.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'src/routes/mod.rs') diff --git a/src/routes/mod.rs b/src/routes/mod.rs index a4d200c..2029bf8 100644 --- a/src/routes/mod.rs +++ b/src/routes/mod.rs @@ -31,6 +31,7 @@ pub fn build_router(state: AppState) -> Router { "/change-password", axum::routing::post(accounts::change_password), ) + .route("/logout", axum::routing::post(crate::auth::logout)) .merge(dashboard::router()) .merge(instances::router()) .merge(players::router()) @@ -42,7 +43,6 @@ pub fn build_router(state: AppState) -> Router { Router::new() .route("/login", axum::routing::get(login_page)) .route("/login", axum::routing::post(crate::auth::authenticate)) - .route("/logout", axum::routing::post(crate::auth::logout)) .merge(protected) .nest_service("/static", ServeDir::new("static")) .with_state(state) -- cgit v1.2.3