security fix

credential_crypto.go

@@ -0,0 +1,29 @@
+package main
+
+import (
+	"encoding/base64"
+	"fmt"
+	"strings"
+)
+
+func sealCredential(prefix, plain string) (string, error) {
+	if plain == "" || strings.HasPrefix(plain, prefix) {
+		return plain, nil
+	}
+	enc, err := encryptSecret(plain)
+	if err != nil {
+		return "", err
+	}
+	return prefix + base64.RawStdEncoding.EncodeToString(enc), nil
+}
+
+func openCredential(prefix, stored string) (string, error) {
+	if !strings.HasPrefix(stored, prefix) {
+		return stored, nil
+	}
+	raw, err := base64.RawStdEncoding.DecodeString(strings.TrimPrefix(stored, prefix))
+	if err != nil {
+		return "", fmt.Errorf("decode encrypted credential: %w", err)
+	}
+	return decryptSecret(raw)
+}

security_hardening_test.go

@@ -0,0 +1,73 @@
+package main
+
+import (
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/hex"
+	"testing"
+	"time"
+)
+
+func TestAdminPasswordHashAndLegacyUpgrade(t *testing.T) {
+	password := "correct-horse-battery-staple"
+	hash, err := hashAdminPassword(password)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if valid, upgrade := verifyAdminPassword(hash, password); !valid || upgrade {
+		t.Fatalf("bcrypt verification = valid %v, upgrade %v", valid, upgrade)
+	}
+	if valid, _ := verifyAdminPassword(hash, "wrong-password"); valid {
+		t.Fatal("wrong bcrypt password was accepted")
+	}
+	legacy := legacyAdminPasswordHash(password)
+	if valid, upgrade := verifyAdminPassword(legacy, password); !valid || !upgrade {
+		t.Fatalf("legacy verification = valid %v, upgrade %v", valid, upgrade)
+	}
+}
+
+func TestTLSDomainRejectsTraversal(t *testing.T) {
+	for _, value := range []string{"../root", `..\\root`, "/absolute", "host\nname"} {
+		if _, _, err := normalizeTLSDomain(value, true); err == nil {
+			t.Fatalf("normalizeTLSDomain(%q) accepted unsafe value", value)
+		}
+	}
+	if domain, _, err := normalizeTLSDomain("vpn.example.com", false); err != nil || domain != "vpn.example.com" {
+		t.Fatalf("valid domain rejected: %q, %v", domain, err)
+	}
+}
+
+func TestManagedServerURLValidation(t *testing.T) {
+	for _, value := range []string{
+		"ftp://example.com", "https://user:pass@example.com", "https://example.com/admin", "http://169.254.10.20",
+	} {
+		if _, err := validateManagedServerBaseURL(value); err == nil {
+			t.Fatalf("validateManagedServerBaseURL(%q) accepted unsafe value", value)
+		}
+	}
+	if got, err := validateManagedServerBaseURL("https://node.example.com/"); err != nil || got != "https://node.example.com" {
+		t.Fatalf("valid managed server URL = %q, %v", got, err)
+	}
+}
+
+func TestMPSignatureRequiresSecretAndValidHMAC(t *testing.T) {
+	const (
+		secret    = "test-secret-with-enough-entropy"
+		dataID    = "123456789"
+		requestID = "request-123"
+	)
+	ts := time.Now().Format("150405")
+	manifest := "id:" + dataID + ";request-id:" + requestID + ";ts:" + ts + ";"
+	mac := hmac.New(sha256.New, []byte(secret))
+	_, _ = mac.Write([]byte(manifest))
+	signature := "ts=" + ts + ",v1=" + hex.EncodeToString(mac.Sum(nil))
+	if !verifyMPSignature(signature, requestID, dataID, secret) {
+		t.Fatal("valid Mercado Pago signature was rejected")
+	}
+	if verifyMPSignature(signature, requestID, dataID, "") {
+		t.Fatal("unsigned webhook mode was accepted")
+	}
+	if verifyMPSignature(signature, requestID, dataID, "wrong-secret") {
+		t.Fatal("signature with wrong secret was accepted")
+	}
+}

security_http.go

@@ -0,0 +1,62 @@
+package main
+
+import (
+	"fmt"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+const maxAdminRequestBody = 8 << 20
+
+// securePanelHandler applies baseline browser protections and a global request
+// body ceiling. Endpoint-specific handlers may impose a smaller limit.
+func securePanelHandler(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("X-Content-Type-Options", "nosniff")
+		w.Header().Set("X-Frame-Options", "DENY")
+		w.Header().Set("Referrer-Policy", "no-referrer")
+		w.Header().Set("Permissions-Policy", "camera=(), microphone=(), geolocation=(), payment=()")
+		w.Header().Set("Cross-Origin-Opener-Policy", "same-origin")
+		w.Header().Set("Content-Security-Policy", "default-src 'self'; base-uri 'none'; frame-ancestors 'none'; object-src 'none'; form-action 'self'; img-src 'self' data:; connect-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'")
+		if strings.HasPrefix(r.URL.Path, "/api/") || r.URL.Path == "/" || r.URL.Path == "/index.html" {
+			w.Header().Set("Cache-Control", "no-store")
+		}
+		if r.Body != nil && r.Method != http.MethodGet && r.Method != http.MethodHead {
+			r.Body = http.MaxBytesReader(w, r.Body, maxAdminRequestBody)
+		}
+		next.ServeHTTP(w, r)
+	})
+}
+
+// writeFileAtomic replaces a sensitive configuration file without leaving a
+// partially written file behind after a crash or interrupted request.
+func writeFileAtomic(path string, data []byte, mode os.FileMode) error {
+	dir := filepath.Dir(path)
+	tmp, err := os.CreateTemp(dir, ".dragoncore-*.tmp")
+	if err != nil {
+		return err
+	}
+	tmpName := tmp.Name()
+	defer os.Remove(tmpName)
+	if err := tmp.Chmod(mode); err != nil {
+		tmp.Close()
+		return err
+	}
+	if _, err := tmp.Write(data); err != nil {
+		tmp.Close()
+		return err
+	}
+	if err := tmp.Sync(); err != nil {
+		tmp.Close()
+		return err
+	}
+	if err := tmp.Close(); err != nil {
+		return err
+	}
+	if err := os.Rename(tmpName, path); err != nil {
+		return fmt.Errorf("replace %s: %w", path, err)
+	}
+	return nil
+}