mirror of
https://github.com/J3vb/OwnCord.git
synced 2026-09-03 03:50:00 +03:00
Applies fixes for 20 adversarially-verified findings from a whole-codebase security review (server side). All Go build-tag variants build, `go vet` is clean, and the suite passes (the sole failing test, ws TestEmitEvents, is a pre-existing nil-harness failure unrelated to these changes). High severity: - auth: close TOCTOU in TOTP verify rate-limit by recording each attempt atomically up-front (was Check-then-Allow), restoring the per-user brute-force cap. - plugin: enforce the CPU/time budget on every WASM guest call via a WithTimeout context (WithCloseOnContextDone interrupts runaways); the configured budget was previously parsed but never applied. - api/waf: inspect request bodies for chunked (ContentLength==-1) requests so the SQLi/XSS/RCE body rules can no longer be bypassed. - ws: rate-limit voice_join/voice_leave and voice_e2ee announce/offer, which fan out to every participant and could force mass disconnects. Medium severity: - api: run bcrypt on the unknown-user login path (no || short-circuit) to remove the timing-based username-enumeration oracle. - ws: verify LiveKit webhooks via the SDK receiver so the signature is bound to the body hash (kills forgery/replay). - authz: require READ_MESSAGES for reactions and for plugin-command broadcasts; route the latter through RequireChannelAccess. - api: cache the client-update signature fetch and rate-limit the endpoint. - service: propagate DeleteOtherSessions failure from ChangePassword instead of silently reporting success. - api: trust the rightmost non-proxy X-Forwarded-For entry, not the client-controllable leftmost one. - plugin: route auto-registered commands through the conflict-checked RegisterCommand; pin the DNS-validated IP for host_http dials (DNS-rebinding TOCTOU). - api: mark access-controlled downloads private/no-cache + Vary: Origin. Low severity: - auth: fail closed when a fully-shaped TOTP ciphertext fails GCM auth (was returning the ciphertext as plaintext). - api: apply the livekit-proxy path allowlist to WebSocket upgrades too. - service: verify attachment ownership before linking (IDOR). - admin: bound the bootstrap setup invite (5 uses / 24h); re-verify the update binary hash immediately before rename+spawn (TOCTOU). - service: require BanMembers + role hierarchy for moderation ban/unban. chore: stop tracking the stray Server/owncord-server.exe build artifact. Test infra: add uploader_id to the hand-rolled ws test attachment schemas and make MemStore.GetAttachmentByID a no-op lookup, matching production/DB behavior. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
42 lines
1.8 KiB
Go
42 lines
1.8 KiB
Go
package ws
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"fmt"
|
|
)
|
|
|
|
// registerVoiceHandlersV1 registers voice handlers that remain V1 (complex
|
|
// state management that hasn't been migrated yet).
|
|
func registerVoiceHandlersV1(r *HandlerRegistry) {
|
|
r.Register(MsgTypeVoiceJoin, func(ctx context.Context, h *Hub, c *Client, _ string, payload json.RawMessage) {
|
|
h.handleVoiceJoin(ctx, c, payload)
|
|
})
|
|
r.Register(MsgTypeVoiceLeave, func(ctx context.Context, h *Hub, c *Client, _ string, _ json.RawMessage) {
|
|
// Rate limit only the explicit client-initiated voice_leave message.
|
|
// handleVoiceLeave is also invoked internally for disconnect and
|
|
// channel-switch cleanup (serve.go, voice_join.go); those paths must
|
|
// never be throttled or they would leak ghost voice states, so the
|
|
// limit lives here in the dispatch wrapper rather than inside the shared
|
|
// handleVoiceLeave routine. Mirrors the voice control Limiter idiom.
|
|
ratKey := fmt.Sprintf("voice_leave:%d", c.userID)
|
|
if h.limiter != nil && !h.limiter.Allow(ratKey, voiceLeaveRateLimit, voiceLeaveWindow) {
|
|
c.sendMsg(buildErrorMsg(ErrCodeRateLimited, "too many voice leave attempts"))
|
|
return
|
|
}
|
|
h.handleVoiceLeave(ctx, c)
|
|
})
|
|
}
|
|
|
|
// registerVoiceControlsV2 registers V2 handlers for voice control toggles
|
|
// and other migrated voice handlers.
|
|
func registerVoiceControlsV2(r *HandlerRegistry, deps VoiceDeps) {
|
|
r.RegisterV2(MsgTypeVoiceMute, handleVoiceMuteV2, deps)
|
|
r.RegisterV2(MsgTypeVoiceDeafen, handleVoiceDeafenV2, deps)
|
|
r.RegisterV2(MsgTypeVoiceCamera, handleVoiceCameraV2, deps)
|
|
r.RegisterV2(MsgTypeVoiceScreenshare, handleVoiceScreenshareV2, deps)
|
|
r.RegisterV2(MsgTypeVoiceE2EEAnnounce, handleVoiceE2EEAnnounceV2, deps)
|
|
r.RegisterV2(MsgTypeVoiceE2EEOffer, handleVoiceE2EEOfferV2, deps)
|
|
r.RegisterV2(MsgTypeVoiceTokenRefresh, handleVoiceTokenRefreshV2, deps)
|
|
}
|