clanker
извршује push на goal/spry-css-updates у Tilo15/astralis
f5c4805b0f Version 0.2.1
7473515476 Merge branch 'goal/security' of Tilo15/astralis into master
2a1e0875ae release 0.2.0: security release, API unchanged at 0.1
- MANIFEST 0.1 -> 0.2.0 for the goal/security release.
- split api_version ('0.1' — library/vapi/gir/pc artifact names, every
downstream consumer depends on them) from release_version (project
version, reaching only the pkg-config Version: field, which usm
validates against the manifest version).
- pin the current inversion-0.1.vapi (Scope.release, inversion f66ed87)
in vapi/ — the system vapi on older hosts predates the API and the
goal/security request-scope lifecycle (Pipeline.release) needs it.
89112b1f37 Security: fix router ** regression, path traversal, request limits, security headers (SA-2, SA-2b, SA-3, SA-13)
Implements the Astralis-side fixes from the security audit in Spry/docs/security-audit.md.
SA-2b: RouteContext built the ** remainder from the route's own segments
instead of the request's, so /assets/** always mapped ** to the literal
"**" and deep static routes 404ed. Restored request-segment semantics
and fixed the bounds check on named-parameter extraction.
SA-2: FilesystemResource guarded traversal with a bare has_prefix check,
which admits sibling directories (/srv/www-evil vs /srv/www) and does not
resolve symlinks. Now any relative path containing a .. component is
rejected outright, both the root and target are resolved symlink-free
(GLib has no g_file_resolve_symbolic_link, so resolution walks the path
with query_info_async + NOFOLLOW_SYMLINKS, following
standard::symlink-target with a loop budget), and containment requires
an exact match or a / boundary.
SA-3: the daemon now starts with MHD_OPTION_CONNECTION_LIMIT,
MHD_OPTION_PER_IP_CONNECTION_LIMIT and
MHD_OPTION_CONNECTION_MEMORY_LIMIT, and request bodies are capped by a
configurable max_request_body (default 10 MiB, server config section).
A declared oversized Content-Length is answered 413 on the headers-only
callback; chunked or lying clients are cut off by a streaming cap in
ServerInput.write with the 413 queued at reception end (MHD forbids
queueing a response from inside an upload-data callback, verified
against minimal C reproducers). The pipeline never runs for a rejected
request so a truncated body cannot produce a competing response.
SA-13: new SecurityHeadersComponent appends X-Content-Type-Options:
nosniff, X-Frame-Options: SAMEORIGIN, Referrer-Policy and a CSP
template by default, never clobbering headers an endpoint set. HSTS is
strictly opt-in via the securityHeaders.hsts config key; every header
can be overridden or disabled through the securityHeaders section.
Tests: new tests/ harness mirroring Statum's (PASS/FAIL prints,
non-zero exit, meson test target). Covers the ** remainder, traversal
rejection (../, %2e%2e%2f, symlink escape, sibling dir, /www vs /www2
boundary), header defaults/overrides, limits config, and end-to-end
413/200 behaviour against a real server.
Also adds HttpContext.from_request for building contexts without a live
server, a get_int64 config accessor, StatusCode.PAYLOAD_TOO_LARGE and
the MHD option constants in the vapi.
eca07a0758 Merge branch 'web-stack' of Tilo15/astralis into master
пре 3 часа