mirror of
https://github.com/J3vb/OwnCord.git
synced 2026-09-03 03:50:00 +03:00
Claude
46aeccc49b
Phase B + C review pass: critical security and correctness fixes. Security - S1: plugin admin endpoints now require admin.RequireAdminAuth in addition to AdminIPRestrict. Previously a LAN attacker on the allowed CIDR could list/enable/disable/uninstall plugins without a session. - S2: rewrite plugin HTTPDo allowlist with proper net/url parsing. Empty entries are ignored, suffix matches require a dot boundary, and a custom Dialer rejects loopback / RFC1918 / link-local addresses to close the DNS-rebinding TOCTOU window. Redirects re-validated. - S3 + #9: manifest Name pinned to ^[a-z0-9][a-z0-9_-]{0,63}$, Entrypoint and UI tab assets validated against absolute / "..", NUL byte, backslash and non-canonical paths. Asset handler hardened with filepath.Rel check for symlink and prefix-without-separator escapes. - S5: pluginBridge postMessage handler ignores the pluginId in the message body and uses an e.source -> contentWindow lookup instead, defeating spoofed messages from same-origin scripts. - S8: HTTPDo body capped at 5 MiB via io.LimitReader, redirects bounded to 5 hops. Correctness - Critical seq alignment: PersistEvent now takes the hub-assigned seq as a required parameter so the events table row seq always matches the wrapped payload seq. Hub seeds its in-memory atomic counter from MAX(events.seq) on startup. Drops in the persister queue no longer mis-align row vs payload seq. - #1: live plugin.Registry constructed in main.go BEFORE NewRouter and threaded through; admin handler is no longer wired with nil. - #3: EventPersister.Stop is now safe to call without a prior Start by tracking a started flag — previously deadlocked waiting on done. Wiring - NewRouter signature gains *plugin.Registry; two test callers updated. - admin.RequireAdminAuth exported as a thin wrapper over the existing package-private adminAuthMiddleware. - sqlc query templates updated for the new PersistEvent + GetMaxEventSeq contracts (sqlite + postgres). https://claude.ai/code/session_01UsBsQW2YiA2usk9pnJjAWk
20 lines
626 B
SQL
20 lines
626 B
SQL
-- name: PersistEvent :exec
|
|
-- seq is supplied by the hub so the row seq matches the wrapped-payload seq.
|
|
-- The schema's BIGSERIAL still owns the id column for inserts that omit seq,
|
|
-- but PersistEvent always supplies an explicit value.
|
|
INSERT INTO events (seq, event_type, channel_id, payload)
|
|
VALUES ($1, $2, $3, $4);
|
|
|
|
-- name: GetMaxEventSeq :one
|
|
SELECT COALESCE(MAX(seq), 0)::BIGINT FROM events;
|
|
|
|
-- name: GetEventsSince :many
|
|
SELECT seq, event_type, channel_id, payload, created_at
|
|
FROM events
|
|
WHERE seq > $1
|
|
ORDER BY seq ASC
|
|
LIMIT $2;
|
|
|
|
-- name: PruneEventsOlderThan :execrows
|
|
DELETE FROM events WHERE created_at < $1;
|