graft-source/internal/ at 96e726f0d7ca2600d8ed17b41f664877aedef254 · graft.pds.cyberwild.org/graft-source · Tangled

graft.pds.cyberwild.org / graft-source

0

Federated via graft

0

graft-source / internal

8 folders

at 96e726f0d7ca2600d8ed17b41f664877aedef254

jeanbaptiste Drop redundant "per repo" from the Social IDs page subtitle 1mo ago

Security audit fixes: SSRF hardening, replay protection, resource limits Addresses every finding from the full-codebase security audit: - CRITICAL: persistent SSRF via ActivityPub actor/inbox URLs. New internal/activitypub/ssrf.go validates every externally-supplied URL (https only, rejects loopback/private/link-local/metadata addresses) and re-validates the resolved IP at dial time to close the DNS-rebinding gap a resolve-then-connect check would leave open. Wired into FetchActor, NewHandler's client, and DeliverNewActivity's per-follower delivery loop. - CRITICAL: state.db (holds every series' ActivityPub private key in plaintext) was world-readable (644) on the live deployment. Open() now hard-fails if it can't chmod the file to 600. - HIGH: no replay protection on inbound HTTP Signatures. VerifyRequest now rejects requests whose Date header is more than 5 minutes stale. - MEDIUM: unbounded upstream response bodies embedded whole into error messages/logs (Forgejo, AT Proto, ActivityPub clients) — capped at 4 MiB/1 MiB read limits with logged bodies truncated to 500 bytes. - MEDIUM: subprocess calls (git, rad) had no timeout, so one hung command could wedge the whole serial sync loop — bounded to 5 minutes via context.WithTimeout/exec.CommandContext. - MEDIUM: Authorized Integrations detection silently disables graft's own push forever once triggered, with no bound — now falls back to pushing directly after 10 consecutive skipped passes. Also fixes a dashboard accuracy issue: a mirror side with zero graft-logged events read as "nothing synced" even when it plainly held the content — the Forgejo side changes originate on (graft only logs the pushes it makes, never the pushes it reads from), or a side that received content via a path graft doesn't log itself (Radicle's own peer-to-peer gossip, or a Forgejo-to-Forgejo Authorized Integration). Those sides now show a distinct "source" or "replicated" badge instead, with a legend entry for each; "nothing synced" is reserved for a series with truly zero activity anywhere. Also: renamed the dashboard subtitle to "Forgejos & Radicles syncs", dropped the redundant "Activity by repo" heading, moved the "last 3 days" window label to the Recent Activity header, and renamed "Social bridges" to "Social IDs" throughout.

1 month ago

Security audit fixes: SSRF hardening, replay protection, resource limits Addresses every finding from the full-codebase security audit: - CRITICAL: persistent SSRF via ActivityPub actor/inbox URLs. New internal/activitypub/ssrf.go validates every externally-supplied URL (https only, rejects loopback/private/link-local/metadata addresses) and re-validates the resolved IP at dial time to close the DNS-rebinding gap a resolve-then-connect check would leave open. Wired into FetchActor, NewHandler's client, and DeliverNewActivity's per-follower delivery loop. - CRITICAL: state.db (holds every series' ActivityPub private key in plaintext) was world-readable (644) on the live deployment. Open() now hard-fails if it can't chmod the file to 600. - HIGH: no replay protection on inbound HTTP Signatures. VerifyRequest now rejects requests whose Date header is more than 5 minutes stale. - MEDIUM: unbounded upstream response bodies embedded whole into error messages/logs (Forgejo, AT Proto, ActivityPub clients) — capped at 4 MiB/1 MiB read limits with logged bodies truncated to 500 bytes. - MEDIUM: subprocess calls (git, rad) had no timeout, so one hung command could wedge the whole serial sync loop — bounded to 5 minutes via context.WithTimeout/exec.CommandContext. - MEDIUM: Authorized Integrations detection silently disables graft's own push forever once triggered, with no bound — now falls back to pushing directly after 10 consecutive skipped passes. Also fixes a dashboard accuracy issue: a mirror side with zero graft-logged events read as "nothing synced" even when it plainly held the content — the Forgejo side changes originate on (graft only logs the pushes it makes, never the pushes it reads from), or a side that received content via a path graft doesn't log itself (Radicle's own peer-to-peer gossip, or a Forgejo-to-Forgejo Authorized Integration). Those sides now show a distinct "source" or "replicated" badge instead, with a legend entry for each; "nothing synced" is reserved for a series with truly zero activity anywhere. Also: renamed the dashboard subtitle to "Forgejos & Radicles syncs", dropped the redundant "Activity by repo" heading, moved the "last 3 days" window label to the Recent Activity header, and renamed "Social bridges" to "Social IDs" throughout.

1 month ago

v2 M5: AT Proto/Bluesky client, wired but inert until credentials exist internal/atproto is a minimal client: Login (app password, never the real account password) via com.atproto.server.createSession, Post via com.atproto.repo.createRecord (app.bsky.feed.post), truncated to Bluesky's 300-rune post limit. A repo pair can now declare an optional bluesky block (handle + app_password_file, same token-file convention as Forgejo). When set, GitSyncer and PatchSyncer post a short note whenever they mirror a new commit or open a patch/PR, alongside the existing activity_log entry. Absent config is a true no-op everywhere (BlueskyPoster.Post is nil-safe) — no account configured, no behavior change, verified live: deployed with zero bluesky config present, service healthy, /social still correctly shows "not configured" for every series. Genuinely untestable further without a real account, as flagged in the v2 plan from the start — the code is complete and defensive (a failed Bluesky call never blocks or fails the sync loop), but live posting is unverified until a dedicated Bluesky handle + app password exists to test against.

1 month ago

Security audit fixes: SSRF hardening, replay protection, resource limits Addresses every finding from the full-codebase security audit: - CRITICAL: persistent SSRF via ActivityPub actor/inbox URLs. New internal/activitypub/ssrf.go validates every externally-supplied URL (https only, rejects loopback/private/link-local/metadata addresses) and re-validates the resolved IP at dial time to close the DNS-rebinding gap a resolve-then-connect check would leave open. Wired into FetchActor, NewHandler's client, and DeliverNewActivity's per-follower delivery loop. - CRITICAL: state.db (holds every series' ActivityPub private key in plaintext) was world-readable (644) on the live deployment. Open() now hard-fails if it can't chmod the file to 600. - HIGH: no replay protection on inbound HTTP Signatures. VerifyRequest now rejects requests whose Date header is more than 5 minutes stale. - MEDIUM: unbounded upstream response bodies embedded whole into error messages/logs (Forgejo, AT Proto, ActivityPub clients) — capped at 4 MiB/1 MiB read limits with logged bodies truncated to 500 bytes. - MEDIUM: subprocess calls (git, rad) had no timeout, so one hung command could wedge the whole serial sync loop — bounded to 5 minutes via context.WithTimeout/exec.CommandContext. - MEDIUM: Authorized Integrations detection silently disables graft's own push forever once triggered, with no bound — now falls back to pushing directly after 10 consecutive skipped passes. Also fixes a dashboard accuracy issue: a mirror side with zero graft-logged events read as "nothing synced" even when it plainly held the content — the Forgejo side changes originate on (graft only logs the pushes it makes, never the pushes it reads from), or a side that received content via a path graft doesn't log itself (Radicle's own peer-to-peer gossip, or a Forgejo-to-Forgejo Authorized Integration). Those sides now show a distinct "source" or "replicated" badge instead, with a legend entry for each; "nothing synced" is reserved for a series with truly zero activity anywhere. Also: renamed the dashboard subtitle to "Forgejos & Radicles syncs", dropped the redundant "Activity by repo" heading, moved the "last 3 days" window label to the Recent Activity header, and renamed "Social bridges" to "Social IDs" throughout.

1 month ago

Security audit fixes: SSRF hardening, replay protection, resource limits Addresses every finding from the full-codebase security audit: - CRITICAL: persistent SSRF via ActivityPub actor/inbox URLs. New internal/activitypub/ssrf.go validates every externally-supplied URL (https only, rejects loopback/private/link-local/metadata addresses) and re-validates the resolved IP at dial time to close the DNS-rebinding gap a resolve-then-connect check would leave open. Wired into FetchActor, NewHandler's client, and DeliverNewActivity's per-follower delivery loop. - CRITICAL: state.db (holds every series' ActivityPub private key in plaintext) was world-readable (644) on the live deployment. Open() now hard-fails if it can't chmod the file to 600. - HIGH: no replay protection on inbound HTTP Signatures. VerifyRequest now rejects requests whose Date header is more than 5 minutes stale. - MEDIUM: unbounded upstream response bodies embedded whole into error messages/logs (Forgejo, AT Proto, ActivityPub clients) — capped at 4 MiB/1 MiB read limits with logged bodies truncated to 500 bytes. - MEDIUM: subprocess calls (git, rad) had no timeout, so one hung command could wedge the whole serial sync loop — bounded to 5 minutes via context.WithTimeout/exec.CommandContext. - MEDIUM: Authorized Integrations detection silently disables graft's own push forever once triggered, with no bound — now falls back to pushing directly after 10 consecutive skipped passes. Also fixes a dashboard accuracy issue: a mirror side with zero graft-logged events read as "nothing synced" even when it plainly held the content — the Forgejo side changes originate on (graft only logs the pushes it makes, never the pushes it reads from), or a side that received content via a path graft doesn't log itself (Radicle's own peer-to-peer gossip, or a Forgejo-to-Forgejo Authorized Integration). Those sides now show a distinct "source" or "replicated" badge instead, with a legend entry for each; "nothing synced" is reserved for a series with truly zero activity anywhere. Also: renamed the dashboard subtitle to "Forgejos & Radicles syncs", dropped the redundant "Activity by repo" heading, moved the "last 3 days" window label to the Recent Activity header, and renamed "Social bridges" to "Social IDs" throughout.

1 month ago

Security audit fixes: SSRF hardening, replay protection, resource limits Addresses every finding from the full-codebase security audit: - CRITICAL: persistent SSRF via ActivityPub actor/inbox URLs. New internal/activitypub/ssrf.go validates every externally-supplied URL (https only, rejects loopback/private/link-local/metadata addresses) and re-validates the resolved IP at dial time to close the DNS-rebinding gap a resolve-then-connect check would leave open. Wired into FetchActor, NewHandler's client, and DeliverNewActivity's per-follower delivery loop. - CRITICAL: state.db (holds every series' ActivityPub private key in plaintext) was world-readable (644) on the live deployment. Open() now hard-fails if it can't chmod the file to 600. - HIGH: no replay protection on inbound HTTP Signatures. VerifyRequest now rejects requests whose Date header is more than 5 minutes stale. - MEDIUM: unbounded upstream response bodies embedded whole into error messages/logs (Forgejo, AT Proto, ActivityPub clients) — capped at 4 MiB/1 MiB read limits with logged bodies truncated to 500 bytes. - MEDIUM: subprocess calls (git, rad) had no timeout, so one hung command could wedge the whole serial sync loop — bounded to 5 minutes via context.WithTimeout/exec.CommandContext. - MEDIUM: Authorized Integrations detection silently disables graft's own push forever once triggered, with no bound — now falls back to pushing directly after 10 consecutive skipped passes. Also fixes a dashboard accuracy issue: a mirror side with zero graft-logged events read as "nothing synced" even when it plainly held the content — the Forgejo side changes originate on (graft only logs the pushes it makes, never the pushes it reads from), or a side that received content via a path graft doesn't log itself (Radicle's own peer-to-peer gossip, or a Forgejo-to-Forgejo Authorized Integration). Those sides now show a distinct "source" or "replicated" badge instead, with a legend entry for each; "nothing synced" is reserved for a series with truly zero activity anywhere. Also: renamed the dashboard subtitle to "Forgejos & Radicles syncs", dropped the redundant "Activity by repo" heading, moved the "last 3 days" window label to the Recent Activity header, and renamed "Social bridges" to "Social IDs" throughout.

1 month ago

Drop redundant "per repo" from the Social IDs page subtitle

1 month ago

Security audit fixes: SSRF hardening, replay protection, resource limits Addresses every finding from the full-codebase security audit: - CRITICAL: persistent SSRF via ActivityPub actor/inbox URLs. New internal/activitypub/ssrf.go validates every externally-supplied URL (https only, rejects loopback/private/link-local/metadata addresses) and re-validates the resolved IP at dial time to close the DNS-rebinding gap a resolve-then-connect check would leave open. Wired into FetchActor, NewHandler's client, and DeliverNewActivity's per-follower delivery loop. - CRITICAL: state.db (holds every series' ActivityPub private key in plaintext) was world-readable (644) on the live deployment. Open() now hard-fails if it can't chmod the file to 600. - HIGH: no replay protection on inbound HTTP Signatures. VerifyRequest now rejects requests whose Date header is more than 5 minutes stale. - MEDIUM: unbounded upstream response bodies embedded whole into error messages/logs (Forgejo, AT Proto, ActivityPub clients) — capped at 4 MiB/1 MiB read limits with logged bodies truncated to 500 bytes. - MEDIUM: subprocess calls (git, rad) had no timeout, so one hung command could wedge the whole serial sync loop — bounded to 5 minutes via context.WithTimeout/exec.CommandContext. - MEDIUM: Authorized Integrations detection silently disables graft's own push forever once triggered, with no bound — now falls back to pushing directly after 10 consecutive skipped passes. Also fixes a dashboard accuracy issue: a mirror side with zero graft-logged events read as "nothing synced" even when it plainly held the content — the Forgejo side changes originate on (graft only logs the pushes it makes, never the pushes it reads from), or a side that received content via a path graft doesn't log itself (Radicle's own peer-to-peer gossip, or a Forgejo-to-Forgejo Authorized Integration). Those sides now show a distinct "source" or "replicated" badge instead, with a legend entry for each; "nothing synced" is reserved for a series with truly zero activity anywhere. Also: renamed the dashboard subtitle to "Forgejos & Radicles syncs", dropped the redundant "Activity by repo" heading, moved the "last 3 days" window label to the Recent Activity header, and renamed "Social bridges" to "Social IDs" throughout.

1 month ago