mirror of
https://github.com/J3vb/OwnCord.git
synced 2026-09-03 03:50:00 +03:00
Claude
1673c37b9c
Addresses 14 findings from the security audit across all severity levels: CRITICAL: - C-1: Add user blocking system (migration, DB queries, REST API, WS DM send check) to prevent harassment via unconsented DMs - C-2: Remove server version from unauthenticated /health and /info endpoints to prevent fingerprinting HIGH: - H-1: Remove dangerous-settings feature from tauri-plugin-http - H-3: Default allowSelfSigned to false in API client (was hardcoded true) - H-4: Cap invite expiration to 30 days (720 hours) - H-5: Add 256KB message size limit to LiveKit WS proxy (prevents OOM) - H-6: Cap concurrent sessions to 25 per user (evicts oldest on overflow) - H-8: Restrict /diagnostics/connectivity to ADMINISTRATOR role MEDIUM: - M-2: Deny access to legacy NULL-uploader unlinked attachments - M-4: Log warnings on TOTP plaintext decryption fallback paths - M-8: Remove acceptInvalidCerts from OG preview fetches - M-10: Expand file upload blocklist (Java .class, OLE2, WASM, .lnk) - M-12: Add LIMIT to ListInvites (200) and ListMembers (1000) - M-14: Add CHECK constraint trigger on channels.type (text/voice/dm) https://claude.ai/code/session_01KKo3RwjdmcNzkgXNfUkgNT
49 lines
1.4 KiB
TOML
49 lines
1.4 KiB
TOML
[package]
|
|
name = "owncord-client"
|
|
version = "1.0.0"
|
|
edition = "2021"
|
|
description = "OwnCord Desktop Client"
|
|
|
|
[lib]
|
|
name = "owncord_client_lib"
|
|
crate-type = ["lib", "cdylib", "staticlib"]
|
|
|
|
[build-dependencies]
|
|
tauri-build = { version = "2", features = [] }
|
|
tauri-typegen = "0.5"
|
|
|
|
[features]
|
|
default = []
|
|
devtools = ["tauri/devtools"]
|
|
|
|
[dependencies]
|
|
tauri = { version = "2", features = ["tray-icon"] }
|
|
tauri-plugin-store = "2"
|
|
tauri-plugin-global-shortcut = "2"
|
|
tauri-plugin-notification = "2"
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
tauri-plugin-http = { version = "2.5.7", features = ["rustls-tls"] }
|
|
tauri-plugin-opener = "2"
|
|
tauri-plugin-dialog = "2"
|
|
tauri-plugin-fs = "2"
|
|
tauri-plugin-updater = "2"
|
|
tauri-plugin-process = "2"
|
|
url = "2"
|
|
tokio-tungstenite = { version = "0.28.0", features = ["rustls-tls-webpki-roots"] }
|
|
futures-util = "0.3.32"
|
|
tokio = { version = "1", features = ["sync", "net", "io-util", "rt", "macros"] }
|
|
tokio-rustls = { version = "0.26", default-features = false }
|
|
rustls = { version = "0.23", default-features = false, features = ["ring", "std"] }
|
|
ring = "0.17"
|
|
log = "0.4"
|
|
env_logger = "0.11"
|
|
keyring = "3"
|
|
rfd = { version = "0.16", default-features = false }
|
|
|
|
[target.'cfg(windows)'.dependencies]
|
|
windows = { version = "0.58", features = ["Win32_UI_Input_KeyboardAndMouse"] }
|
|
|
|
[target.'cfg(target_os = "linux")'.dependencies]
|
|
device_query = "2"
|