From 92c5c2ace669fa3dbae751ea495d2612b1c51775 Mon Sep 17 00:00:00 2001 From: penguinehis Date: Mon, 13 Jul 2026 00:57:35 -0300 Subject: [PATCH] security fix --- credential_crypto.go | 29 +++++++++++++++ security_hardening_test.go | 73 ++++++++++++++++++++++++++++++++++++++ security_http.go | 62 ++++++++++++++++++++++++++++++++ 3 files changed, 164 insertions(+) create mode 100644 credential_crypto.go create mode 100644 security_hardening_test.go create mode 100644 security_http.go diff --git a/credential_crypto.go b/credential_crypto.go new file mode 100644 index 0000000..228d46c --- /dev/null +++ b/credential_crypto.go @@ -0,0 +1,29 @@ +package main + +import ( + "encoding/base64" + "fmt" + "strings" +) + +func sealCredential(prefix, plain string) (string, error) { + if plain == "" || strings.HasPrefix(plain, prefix) { + return plain, nil + } + enc, err := encryptSecret(plain) + if err != nil { + return "", err + } + return prefix + base64.RawStdEncoding.EncodeToString(enc), nil +} + +func openCredential(prefix, stored string) (string, error) { + if !strings.HasPrefix(stored, prefix) { + return stored, nil + } + raw, err := base64.RawStdEncoding.DecodeString(strings.TrimPrefix(stored, prefix)) + if err != nil { + return "", fmt.Errorf("decode encrypted credential: %w", err) + } + return decryptSecret(raw) +} diff --git a/security_hardening_test.go b/security_hardening_test.go new file mode 100644 index 0000000..081b97e --- /dev/null +++ b/security_hardening_test.go @@ -0,0 +1,73 @@ +package main + +import ( + "crypto/hmac" + "crypto/sha256" + "encoding/hex" + "testing" + "time" +) + +func TestAdminPasswordHashAndLegacyUpgrade(t *testing.T) { + password := "correct-horse-battery-staple" + hash, err := hashAdminPassword(password) + if err != nil { + t.Fatal(err) + } + if valid, upgrade := verifyAdminPassword(hash, password); !valid || upgrade { + t.Fatalf("bcrypt verification = valid %v, upgrade %v", valid, upgrade) + } + if valid, _ := verifyAdminPassword(hash, "wrong-password"); valid { + t.Fatal("wrong bcrypt password was accepted") + } + legacy := legacyAdminPasswordHash(password) + if valid, upgrade := verifyAdminPassword(legacy, password); !valid || !upgrade { + t.Fatalf("legacy verification = valid %v, upgrade %v", valid, upgrade) + } +} + +func TestTLSDomainRejectsTraversal(t *testing.T) { + for _, value := range []string{"../root", `..\\root`, "/absolute", "host\nname"} { + if _, _, err := normalizeTLSDomain(value, true); err == nil { + t.Fatalf("normalizeTLSDomain(%q) accepted unsafe value", value) + } + } + if domain, _, err := normalizeTLSDomain("vpn.example.com", false); err != nil || domain != "vpn.example.com" { + t.Fatalf("valid domain rejected: %q, %v", domain, err) + } +} + +func TestManagedServerURLValidation(t *testing.T) { + for _, value := range []string{ + "ftp://example.com", "https://user:pass@example.com", "https://example.com/admin", "http://169.254.10.20", + } { + if _, err := validateManagedServerBaseURL(value); err == nil { + t.Fatalf("validateManagedServerBaseURL(%q) accepted unsafe value", value) + } + } + if got, err := validateManagedServerBaseURL("https://node.example.com/"); err != nil || got != "https://node.example.com" { + t.Fatalf("valid managed server URL = %q, %v", got, err) + } +} + +func TestMPSignatureRequiresSecretAndValidHMAC(t *testing.T) { + const ( + secret = "test-secret-with-enough-entropy" + dataID = "123456789" + requestID = "request-123" + ) + ts := time.Now().Format("150405") + manifest := "id:" + dataID + ";request-id:" + requestID + ";ts:" + ts + ";" + mac := hmac.New(sha256.New, []byte(secret)) + _, _ = mac.Write([]byte(manifest)) + signature := "ts=" + ts + ",v1=" + hex.EncodeToString(mac.Sum(nil)) + if !verifyMPSignature(signature, requestID, dataID, secret) { + t.Fatal("valid Mercado Pago signature was rejected") + } + if verifyMPSignature(signature, requestID, dataID, "") { + t.Fatal("unsigned webhook mode was accepted") + } + if verifyMPSignature(signature, requestID, dataID, "wrong-secret") { + t.Fatal("signature with wrong secret was accepted") + } +} diff --git a/security_http.go b/security_http.go new file mode 100644 index 0000000..d683902 --- /dev/null +++ b/security_http.go @@ -0,0 +1,62 @@ +package main + +import ( + "fmt" + "net/http" + "os" + "path/filepath" + "strings" +) + +const maxAdminRequestBody = 8 << 20 + +// securePanelHandler applies baseline browser protections and a global request +// body ceiling. Endpoint-specific handlers may impose a smaller limit. +func securePanelHandler(next http.Handler) http.Handler { + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + w.Header().Set("X-Content-Type-Options", "nosniff") + w.Header().Set("X-Frame-Options", "DENY") + w.Header().Set("Referrer-Policy", "no-referrer") + w.Header().Set("Permissions-Policy", "camera=(), microphone=(), geolocation=(), payment=()") + w.Header().Set("Cross-Origin-Opener-Policy", "same-origin") + w.Header().Set("Content-Security-Policy", "default-src 'self'; base-uri 'none'; frame-ancestors 'none'; object-src 'none'; form-action 'self'; img-src 'self' data:; connect-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'") + if strings.HasPrefix(r.URL.Path, "/api/") || r.URL.Path == "/" || r.URL.Path == "/index.html" { + w.Header().Set("Cache-Control", "no-store") + } + if r.Body != nil && r.Method != http.MethodGet && r.Method != http.MethodHead { + r.Body = http.MaxBytesReader(w, r.Body, maxAdminRequestBody) + } + next.ServeHTTP(w, r) + }) +} + +// writeFileAtomic replaces a sensitive configuration file without leaving a +// partially written file behind after a crash or interrupted request. +func writeFileAtomic(path string, data []byte, mode os.FileMode) error { + dir := filepath.Dir(path) + tmp, err := os.CreateTemp(dir, ".dragoncore-*.tmp") + if err != nil { + return err + } + tmpName := tmp.Name() + defer os.Remove(tmpName) + if err := tmp.Chmod(mode); err != nil { + tmp.Close() + return err + } + if _, err := tmp.Write(data); err != nil { + tmp.Close() + return err + } + if err := tmp.Sync(); err != nil { + tmp.Close() + return err + } + if err := tmp.Close(); err != nil { + return err + } + if err := os.Rename(tmpName, path); err != nil { + return fmt.Errorf("replace %s: %w", path, err) + } + return nil +}