vikingowl
5821547a73
Implements the remediation pass described in planning/19-security-audit-2026-04-30.md. All Critical findings and the Wave 1-4 High findings are closed; PoC tests added; full backend test suite green; helm chart lints clean. Wave 1 - Auth & identity - C1 OAuth state nonce: PutOAuthState / ConsumeOAuthState (valkey, GETDEL single-use, 15min TTL); Callback rejects missing/forged/cross- provider state before token exchange. - C2 OAuth identity linking: refuse silent linking to existing user unless info.EmailVerified is true. fetchGitHubUser now consults the /user/emails endpoint for the verified flag (no more hardcoded true); fetchFacebookUser sets EmailVerified=false (FB exposes no per-email verification flag). - H1 Magic-link verify: replaced Get + MarkUsed with a single atomic UPDATE...RETURNING (ConsumeMagicLink) - TOCTOU-free. - H2 TOTP code replay: MarkTOTPCodeConsumed (valkey SET NX, 120s TTL) prevents replay of a successfully validated code; fails closed on transient store errors. - H3 Backup-code orphan: DisableTOTP now also wipes totp_backup_codes. Wave 2 - Middleware & network - C3 CORS/CSRF regex anchoring: NewCORSConfig wraps each pattern with \A...\z so substring spoofing of origins is impossible. - H4 ClientIP: server reads APP_TRUSTED_PROXIES; gin SetTrustedProxies is called explicitly (empty default = no proxy trust). - H11 Body limit + DisallowUnknownFields: BodyLimitBytes middleware (1 MiB default) wraps every request; validate.BindJSON now uses a json.Decoder with DisallowUnknownFields and rejects trailing tokens; 413 envelope on body-limit overflow. - H16 NetworkPolicy: backend.networkPolicy.enabled defaults to true; new web-networkpolicy.yaml restricts web pod ingress to nginx-gateway and egress to backend service + DNS + 443. Wave 3 - Encryption at rest - C4 TOTP secrets: CreateTOTPSecret writes encrypted secret_v2; GetTOTPSecret prefers v2 with legacy fallback. - C5 OAuth tokens: migration 000033 adds *_v2 columns; CreateOAuthAccount and UpdateOAuthTokens write encrypted; GetOAuthAccount reads v2 with legacy fallback. - M1 Domain separation: crypto.DeriveKeyFor(secret, purpose) replaces single-purpose DeriveKey; settings, totp, oauth each use a distinct HKDF-derived subkey. DeriveKey kept as back-compat alias for settings. Wave 4 - Input & AI safety - C6 SSRF: new pkg/safehttp refuses to dial RFC1918, loopback, link- local, ULA, multicast, unspecified, or cloud-metadata IPs; scheme allowlist (http/https). Wired into pkg/scrape, discovery LinkChecker, and imageURLReachable. NewForTesting opt-in for httptest. - H13 PromptGuard German + Unicode: NFKC + Cf-class strip pre-pass closes zero-width and full-width-homoglyph bypasses; new German rules for ignoriere/missachte/vergiss/role-escalation/prompt-exfil/verbatim; Gemma-style and pipe-delimited chat-template tokens covered; source-fence rule prevents '=== Quelle:' splice in scraped text. - H14 BudgetGate: new ai.BudgetGate interface; UsageRepo.CheckBudget reads today's SUM(estimated_cost_usd) (10s cache) and refuses calls when AI_DAILY_CAP_USD is exceeded; GeminiProvider.Chat checks the gate before contacting Gemini. OAuth routes remain disabled in server/routes.go, so C1/C2 are not actively reachable today; fixes ensure correctness when re-enabled.
82 lines
2.4 KiB
Go
82 lines
2.4 KiB
Go
package validate
|
|
|
|
import (
|
|
"encoding/json"
|
|
"errors"
|
|
"fmt"
|
|
"io"
|
|
"net/http"
|
|
"strings"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
"github.com/go-playground/validator/v10"
|
|
|
|
"marktvogt.de/backend/internal/pkg/apierror"
|
|
)
|
|
|
|
var v = validator.New()
|
|
|
|
func Struct(s any) *apierror.Error {
|
|
if err := v.Struct(s); err != nil {
|
|
var ve validator.ValidationErrors
|
|
if errors.As(err, &ve) {
|
|
var msgs []string
|
|
for _, fe := range ve {
|
|
msgs = append(msgs, formatFieldError(fe))
|
|
}
|
|
return apierror.Validation(strings.Join(msgs, "; "))
|
|
}
|
|
return apierror.Validation(err.Error())
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// BindJSON decodes the request body into dest and runs struct validation.
|
|
// Unlike gin's ShouldBindJSON it (a) refuses unknown JSON fields and (b)
|
|
// surfaces http.MaxBytesReader limits as a 413 instead of a generic 400.
|
|
// Together with middleware.BodyLimitBytes this closes audit H11.
|
|
func BindJSON(c *gin.Context, dest any) *apierror.Error {
|
|
if c.Request == nil || c.Request.Body == nil {
|
|
return apierror.BadRequest("invalid_json", "request body is required")
|
|
}
|
|
dec := json.NewDecoder(c.Request.Body)
|
|
dec.DisallowUnknownFields()
|
|
|
|
if err := dec.Decode(dest); err != nil {
|
|
var maxErr *http.MaxBytesError
|
|
if errors.As(err, &maxErr) {
|
|
return &apierror.Error{
|
|
Status: http.StatusRequestEntityTooLarge,
|
|
Code: "body_too_large",
|
|
Message: fmt.Sprintf("request body exceeds %d bytes", maxErr.Limit),
|
|
}
|
|
}
|
|
return apierror.BadRequest("invalid_json", fmt.Sprintf("invalid request body: %s", err.Error()))
|
|
}
|
|
// Reject trailing JSON tokens — `{"a":1}{"b":2}` should not silently parse.
|
|
if err := dec.Decode(&struct{}{}); err != io.EOF {
|
|
return apierror.BadRequest("invalid_json", "request body must contain a single JSON document")
|
|
}
|
|
return Struct(dest)
|
|
}
|
|
|
|
func formatFieldError(fe validator.FieldError) string {
|
|
field := fe.Field()
|
|
switch fe.Tag() {
|
|
case "required":
|
|
return fmt.Sprintf("%s is required", field)
|
|
case "email":
|
|
return fmt.Sprintf("%s must be a valid email address", field)
|
|
case "min":
|
|
return fmt.Sprintf("%s must be at least %s characters", field, fe.Param())
|
|
case "max":
|
|
return fmt.Sprintf("%s must be at most %s characters", field, fe.Param())
|
|
case "gte":
|
|
return fmt.Sprintf("%s must be at least %s", field, fe.Param())
|
|
case "lte":
|
|
return fmt.Sprintf("%s must be at most %s", field, fe.Param())
|
|
default:
|
|
return fmt.Sprintf("%s failed validation: %s", field, fe.Tag())
|
|
}
|
|
}
|