 jevb
|
4c4526e539
|
fix: security hardening — 45 issues from full-project Copilot audit
Critical (6):
- C1: SQL injection in VACUUM INTO backup path — strict character allowlist
- C2: Unlimited binary download in updater — 500MB LimitReader
- C3: JSON injection in SSE log stream — json.Marshal instead of concat
- C4: CSS injection via custom themes — reject () and {} in values
- C5: Silent DM message loss — error response on participant lookup failure
- C6: LiveKit URL credential leak — strip creds from diagnostics endpoint
High (11):
- H1: DB errors no longer trigger login rate-limit lockout
- H2: Permission fetch failure returns 500, not empty channel list
- H3: TOCTOU race on duplicate WS — atomic check-and-register in hub
- H5: LiveKit webhook verifies voice channel match (already implemented)
- H7: Server host address validated before storage (hostname regex)
- H8: WS message deduplication on reconnect replay (1000-entry Set)
- H9: Admin setup endpoint rate limited (5/min/IP)
- H10: Backup responses return filename only, not full path
- H11: Update binary recovery failure now alerts admin
Medium (17):
- M1: MIME type from magic bytes, not client header
- M3: Nil guard on DM broadcast recipient
- M5: LiveKit process run-done channel race fixed
- M6: Backup restore calls fsync before close
- M7: Partial download file cleaned up on error
- M8: Admin CSP uses nonce instead of unsafe-inline
- M9: Client rate limiter enforced for presence_update
- M10: Voice joinedAt not reset on double-join
- M11: Unread count skips increment during reconnect replay
- M13: Category type uses exact match, not substring
- M14: Storage LimitReader off-by-one fixed
- M15: GitHub token only sent to GitHub hosts
- M16: Content-parser ReDoS regex replaced with split approach
- M17: Audio device switch error handling added
Low (11):
- L1: CORS uses configured origins instead of wildcard
- L2: HSTS header added when TLS enabled
- L3: Consistent JSON error responses across all endpoints
- L4: File modtime from stat, not time.Now()
- L5: Malformed invite JSON returns 400
- L6: TouchSession failure logged at warn
- L8: MessageInput timers cleared on destroy
- L9: Log persistence flush errors caught
- L10: Credential save failure surfaced to user
- L11: Case-insensitive asset name matching in updater
Found by GitHub Copilot full-project review (claude-sonnet-4.6 + claude-haiku-4.5).
|
2026-03-29 12:35:04 +02:00 |
|
|
jevb
|
f30d267fda
|
feat: add observability, debugging, and diagnostics across all layers
Phase 1 — Server-side logging:
- Enhance HTTP request logging with client_ip, bytes, req_id
- Enrich WS disconnect logs with duration, msgs received/sent/dropped,
voice channel, and last error
- Add structured logging to LiveKit webhook events
- Enrich voice join/leave logs with username, remote addr, quality,
channel occupancy
- Add channel_id to voice control debug logs
Phase 1 — Client log persistence:
- New logPersistence.ts: rotating JSONL files in appLogDir with
5-day retention, 2s debounced flush, append mode
- Wire into app startup with flush on beforeunload
- Scope all new FS capabilities to $APPLOG/**
Phase 1 — Rust proxy logging:
- Replace eprintln! with structured log crate (info/warn/error/debug)
in livekit_proxy.rs and ws_proxy.rs
- Add env_logger with try_init for safe initialization
- Log TLS handshakes, TOFU checks, connection lifecycle, byte counts
Phase 1 — Cache management UI:
- Add Clear Image Cache, Clear Log Files, and Clear All Cache & Restart
buttons to Settings > Advanced with confirmation dialog
Phase 2 — LiveKit ICE and lifecycle logging:
- Log ICE candidate types (host/srflx/relay) and selected candidate pair
on every voice connect and auto-reconnect
- Add room lifecycle event handlers: Reconnecting, Reconnected,
SignalReconnecting, MediaDevicesError, ConnectionQualityChanged
- Expose ICE connection state in getSessionDebugInfo()
Phase 2 — WebSocket reconnection logging:
- Structured reconnection logs with host, attempt, lastSeq
- Log reconnect success with attempt count
- Detailed connection state transitions (open/close with context)
Phase 2 — Server diagnostics endpoint:
- GET /api/v1/diagnostics/connectivity (auth required)
- Returns server info, LiveKit health/URL/node_ip, client remote_addr,
and private network detection
|
2026-03-28 20:42:37 +01:00 |
|