mirror of
https://github.com/J3vb/OwnCord.git
synced 2026-09-03 03:50:00 +03:00
Applies fixes for 20 adversarially-verified findings from a whole-codebase security review (server side). All Go build-tag variants build, `go vet` is clean, and the suite passes (the sole failing test, ws TestEmitEvents, is a pre-existing nil-harness failure unrelated to these changes). High severity: - auth: close TOCTOU in TOTP verify rate-limit by recording each attempt atomically up-front (was Check-then-Allow), restoring the per-user brute-force cap. - plugin: enforce the CPU/time budget on every WASM guest call via a WithTimeout context (WithCloseOnContextDone interrupts runaways); the configured budget was previously parsed but never applied. - api/waf: inspect request bodies for chunked (ContentLength==-1) requests so the SQLi/XSS/RCE body rules can no longer be bypassed. - ws: rate-limit voice_join/voice_leave and voice_e2ee announce/offer, which fan out to every participant and could force mass disconnects. Medium severity: - api: run bcrypt on the unknown-user login path (no || short-circuit) to remove the timing-based username-enumeration oracle. - ws: verify LiveKit webhooks via the SDK receiver so the signature is bound to the body hash (kills forgery/replay). - authz: require READ_MESSAGES for reactions and for plugin-command broadcasts; route the latter through RequireChannelAccess. - api: cache the client-update signature fetch and rate-limit the endpoint. - service: propagate DeleteOtherSessions failure from ChangePassword instead of silently reporting success. - api: trust the rightmost non-proxy X-Forwarded-For entry, not the client-controllable leftmost one. - plugin: route auto-registered commands through the conflict-checked RegisterCommand; pin the DNS-validated IP for host_http dials (DNS-rebinding TOCTOU). - api: mark access-controlled downloads private/no-cache + Vary: Origin. Low severity: - auth: fail closed when a fully-shaped TOTP ciphertext fails GCM auth (was returning the ciphertext as plaintext). - api: apply the livekit-proxy path allowlist to WebSocket upgrades too. - service: verify attachment ownership before linking (IDOR). - admin: bound the bootstrap setup invite (5 uses / 24h); re-verify the update binary hash immediately before rename+spawn (TOCTOU). - service: require BanMembers + role hierarchy for moderation ban/unban. chore: stop tracking the stray Server/owncord-server.exe build artifact. Test infra: add uploader_id to the hand-rolled ws test attachment schemas and make MemStore.GetAttachmentByID a no-op lookup, matching production/DB behavior. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
43 lines
1.4 KiB
Go
43 lines
1.4 KiB
Go
// Package service provides the domain service layer for OwnCord.
|
|
// Services encapsulate business logic (validation, permission checks, DB operations)
|
|
// that was previously scattered across REST and WebSocket handlers.
|
|
// Both REST and WS handlers become thin adapters that call service methods.
|
|
package service
|
|
|
|
import (
|
|
"github.com/owncord/server/auth"
|
|
"github.com/owncord/server/permissions"
|
|
"github.com/owncord/server/store"
|
|
)
|
|
|
|
// Services bundles all domain services for dependency injection.
|
|
// Handlers receive this struct instead of raw *db.DB references.
|
|
type Services struct {
|
|
Messages *MessageService
|
|
Channels *ChannelService
|
|
Permissions *PermissionService
|
|
Users *UserService
|
|
DMs *DMService
|
|
Invites *InviteService
|
|
Blocks *BlockService
|
|
Moderation *ModerationService
|
|
Voice *VoiceService
|
|
}
|
|
|
|
// New creates all domain services wired together.
|
|
func New(st store.Store, limiter *auth.RateLimiter) *Services {
|
|
permChecker := permissions.NewChecker(st)
|
|
permSvc := NewPermissionService(st, permChecker)
|
|
return &Services{
|
|
Messages: NewMessageService(st, permSvc, limiter),
|
|
Channels: NewChannelService(st, permSvc),
|
|
Permissions: permSvc,
|
|
Users: NewUserService(st),
|
|
DMs: NewDMService(st),
|
|
Invites: NewInviteService(st),
|
|
Blocks: NewBlockService(st),
|
|
Moderation: NewModerationService(st, permSvc),
|
|
Voice: NewVoiceService(st, permSvc),
|
|
}
|
|
}
|