From 07b59ca48555f84afff1de01eebbac5a09f9d4d5 Mon Sep 17 00:00:00 2001 From: J3vb <192430104+J3vb@users.noreply.github.com> Date: Thu, 23 Jul 2026 14:55:08 +0200 Subject: [PATCH] docs(plans): amend security plan trackers; close A-2026-07-15 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - security-hardening-remediation.md: status header now records that only W2-4 and W3-3 remain open (verified by the 2026-07-23 deletion audit), with a staleness note scoping the deleted store/-and-Postgres references as historical. Closes audit finding A-2026-07-15. - security-scan-2026-07-22-remediation.md: F6 recorded as committed (ef58c04); resume checklist trimmed — F3 (voice E2EE identity TOFU) is the only remaining finding. - audit-2026-07-19.md: A-2026-07-15 closure row flipped to RESOLVED. Co-Authored-By: Claude Fable 5 --- docs/audit-2026-07-19.md | 2 +- docs/plans/security-hardening-remediation.md | 11 ++++++++++- docs/plans/security-scan-2026-07-22-remediation.md | 11 +++++------ 3 files changed, 16 insertions(+), 8 deletions(-) diff --git a/docs/audit-2026-07-19.md b/docs/audit-2026-07-19.md index 7b0f100a..37febbf4 100644 --- a/docs/audit-2026-07-19.md +++ b/docs/audit-2026-07-19.md @@ -28,7 +28,7 @@ accepted-risk note before the beta gate. MEDIUMs are folded into the backlog | A-2026-07-12 | MEDIUM | Abandoned SolidJS beachhead still in-tree; `docs/client-architecture.md` describes the abandoned architecture | CLOSED 2026-07-19 — beachhead, adapters, build plugin, and Solid deps removed; client-architecture.md retired in favor of architecture/client.md | | A-2026-07-13 | LOW | Dead schema: `sounds` table survives soundboard removal (correction 2026-07-19: `audit_log_v6` is only a transient rename inside migration 003, not a coexisting table) | OPEN | | A-2026-07-14 | LOW | Scattered client constants (`#5865F2` ×18, `localhost:8443` ×3); 64 timer call sites with manual lifecycle | OPEN | -| A-2026-07-15 | LOW | `docs/plans/security-hardening-remediation.md` partly stale (references deleted `store/postgres.go`) | OPEN | +| A-2026-07-15 | LOW | `docs/plans/security-hardening-remediation.md` partly stale (references deleted `store/postgres.go`) | RESOLVED 2026-07-23 — staleness note added scoping the dead `store/`/Postgres references as historical; status header now records that only W2-4 and W3-3 remain open, with the doc as their tracker of record | | A-2026-07-16 | HIGH | Server-wide permission rule hand-rolled at 2 sites (`RequirePermission` raw any-of bit test; `ModerationService`); channel-level `deny` silently dropped — and cached for 30s — when the override fetch errors, at 2 of 5 sites | RESOLVED 2026-07-23 (D13) — `permissions.HasServerPerm` now owns the server-scoped rule (both sites collapse onto it; multi-bit masks are all-of); both override-fetch sites fail closed (`getOrPopulate` skips the fetch for admins, denies and caches nothing on error; `ListVisibleChannels` returns `ErrInternal`); the fifth D9 site (`GetAccessibleChannelIDs`) routes through `VisibleChannelIDs`. Locked by failing-first tests. See [plans/permission-middleware-consolidation.md](plans/permission-middleware-consolidation.md) | --- diff --git a/docs/plans/security-hardening-remediation.md b/docs/plans/security-hardening-remediation.md index 405290f0..323c56e6 100644 --- a/docs/plans/security-hardening-remediation.md +++ b/docs/plans/security-hardening-remediation.md @@ -1,10 +1,19 @@ # Plan: Remediate security-hardening review regressions -**Status:** design only, not implemented +**Status:** mostly landed — verified 2026-07-23 (deletion audit): every item +except **W2-4** and **W3-3** has been implemented or superseded. This doc is +the tracker of record for those two; close it when they land. **Owner:** TBD **Tracks:** code review of branch `fix/security-hardening-review` (2026-07-17) **Estimated effort:** 2–4 focused days +> **Staleness note (2026-07-23, closes audit A-2026-07-15):** item bodies below +> predate two structural changes — the Postgres backend was deleted outright +> (P1, 2026-07-20) and the `Server/store/` seam was removed in favor of direct +> narrow interfaces on `db` (D3, 2026-07-19). Read `Server/store/postgres.go` +> / `sqlite.go` references as historical; the Postgres halves of W1-3 are moot, +> and its atomic-link half is what W2-4 still needs. + ## Why The `fix/security-hardening-review` branch lands a broad, well-intentioned diff --git a/docs/plans/security-scan-2026-07-22-remediation.md b/docs/plans/security-scan-2026-07-22-remediation.md index f6615be9..e771c683 100644 --- a/docs/plans/security-scan-2026-07-22-remediation.md +++ b/docs/plans/security-scan-2026-07-22-remediation.md @@ -15,7 +15,7 @@ This is a continuation/handoff doc: what is done, what remains, and how to resum | F3 | MED | Voice E2EE trusts server-relayed ECDH keys (server MITM) | ⏳ **TODO — designed, not started** | | F4 | MED | HTTP TOFU proxy accepts any cert on first use (credential exposure) | ✅ done, committed `f22985a` | | F5 | LOW | Voice perms use stale connect-time role snapshot | ✅ done, committed `260d038` | -| F6 | LOW | Lost cache invalidation in `PermissionService.getOrPopulate` | ✅ done, **uncommitted** (see note) | +| F6 | LOW | Lost cache invalidation in `PermissionService.getOrPopulate` | ✅ done, committed `e6a0d87` | | F7 | LOW | ReDoS regex on link-preview HTML | ✅ done, committed `6952202` | | F8 | LOW | WS TOFU verifier accepts any cert on first use | ✅ done, committed `f22985a` (with F4) | @@ -26,12 +26,11 @@ This is a continuation/handoff doc: what is done, what remains, and how to resum `cd Client/tauri-client/src-tauri && cargo clippy -- -D warnings` (or push and let CI do it). Pure `tofu` logic has `#[cfg(test)]` unit tests; the frontend is covered by the 3311-green unit suite. -2. **F6 commit:** F6 lives in `Server/service/permission.go`, entangled with the - uncommitted permission-consolidation edits. It rides with that work (per - decision) — commit it when the consolidation branch lands, or cherry-pick. -3. **Then F3** — the only remaining finding (below). +2. **Then F3** — the only remaining finding (below). (F6 landed 2026-07-23 as + `e6a0d87`, split out from the D13 permission-consolidation commits that + followed it on this branch.) -## F6 detail (done, pending commit) +## F6 detail (done, committed `e6a0d87`) `getOrPopulate` read the DB then cached the snapshot with no version guard, so a concurrent `InvalidateUser` racing the populate was silently overwritten (stale