mirror of
https://github.com/J3vb/OwnCord.git
synced 2026-09-03 03:50:00 +03:00
J3vbandClaude Opus 4.8
1485e13f9a
The http and ws proxies accepted ANY certificate on first use and silently pinned it, forwarding login credentials and the bearer token before the user ever saw the fingerprint — an on-path attacker at first contact captured them. The three proxies also duplicated the TLS verifier and TOFU logic verbatim. - Extract the shared verifier, cert-store helpers, and a pure `decide` function into src-tauri/src/tofu.rs (used by the http/ws/livekit proxies). - Split the trust decision from persistence: a first-use cert is no longer pinned or forwarded to. The proxy rejects (ws: Err; http: 502) and emits a cert-tofu "first_use" event; the only writer of a pin is the explicit accept_cert_fingerprint command. - Frontend: a global cert-tofu listener (active during the connect page's health checks, before any WS connect) surfaces an SSH-style first-use confirmation modal. On accept the fingerprint is pinned and the server re-checked; nothing is sent to an unconfirmed host. Closes security-scan F4 (http proxy) and F8 (ws proxy). Verified: client typecheck/lint/format clean, full unit suite 3311/3311 green (incl. new ws first-use routing + modal tests). Rust compiles in CI (cargo clippy) per the client CLAUDE.md; pure tofu logic covered by #[cfg(test)] unit tests. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>