owenandClaude Sonnet 5
789bf91eed
Security: - New internal/netguard package: podcast feed/enclosure fetching now refuses to dial non-public IPs (loopback/RFC1918/link-local/cloud metadata/CGNAT), validated per-connection including across redirects, closing an SSRF gap where a malicious or compromised feed URL could probe the server's internal network. Configurable via VIBESONIC_PODCASTS_ALLOW_PRIVATE_NETWORKS for intentional LAN feeds. - Podcast episode downloads capped at 4GB (was unbounded, disk-exhaustion risk) - Cover art decoding now rejects images above a 40-megapixel budget before full decode (decompression-bomb guard) - HTTP server sets ReadHeaderTimeout (slowloris hardening) - Admin folder-scan redirect now validated as same-site instead of trusting the raw Referer header (open-redirect fix) - Legacy Subsonic token/salt auth now uses a constant-time comparison Web UI completion: - Persistent player: shuffle and repeat (off/all/one) controls, wired into queue advance/prev logic and persisted like other player state - Admin user-permissions form: adminRole toggle (with a guard against demoting the last remaining admin) and per-user music-folder access checkboxes, backed by existing schema/enforcement that was previously unreachable from the UI - Playlist M3U8 import/export Docs: added docs/client-compatibility.md (honest tracking template — no client testing has been performed), docs/deployment.md, docs/security.md, docs/backup.md; refreshed README and cross-links; added a footnote in docs/subsonic-compatibility.md distinguishing spec-standard from VibeSonic-original OpenSubsonic extensions. Also added Go fuzz tests for the external-auth CIDR/IP parser and the LRC lyrics parser. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014r98AtcBbevpscWLsfwVvv
54 lines
1.2 KiB
Go
54 lines
1.2 KiB
Go
package netguard
|
|
|
|
import (
|
|
"net"
|
|
"testing"
|
|
)
|
|
|
|
// FuzzValidateURL guards against a crash in the podcast feed/enclosure
|
|
// URL sanity check — the URLs it validates are admin-supplied but the
|
|
// check must never panic regardless of input.
|
|
func FuzzValidateURL(f *testing.F) {
|
|
f.Add("https://example.com/feed.xml")
|
|
f.Add("http://127.0.0.1/feed")
|
|
f.Add("ftp://example.com")
|
|
f.Add("not a url at all")
|
|
f.Add("")
|
|
f.Add("http://")
|
|
f.Add("javascript:alert(1)")
|
|
f.Add("http://[::1]:8080/feed")
|
|
|
|
f.Fuzz(func(t *testing.T, raw string) {
|
|
defer func() {
|
|
if r := recover(); r != nil {
|
|
t.Fatalf("ValidateURL panicked on %q: %v", raw, r)
|
|
}
|
|
}()
|
|
_ = ValidateURL(raw)
|
|
})
|
|
}
|
|
|
|
// FuzzIsPublicIP guards the address classifier that decides whether a
|
|
// resolved IP is safe to connect to.
|
|
func FuzzIsPublicIP(f *testing.F) {
|
|
f.Add("8.8.8.8")
|
|
f.Add("127.0.0.1")
|
|
f.Add("::1")
|
|
f.Add("169.254.169.254")
|
|
f.Add("100.64.0.1")
|
|
f.Add("::ffff:127.0.0.1")
|
|
|
|
f.Fuzz(func(t *testing.T, s string) {
|
|
ip := net.ParseIP(s)
|
|
if ip == nil {
|
|
return
|
|
}
|
|
defer func() {
|
|
if r := recover(); r != nil {
|
|
t.Fatalf("IsPublicIP panicked on %q: %v", s, r)
|
|
}
|
|
}()
|
|
IsPublicIP(ip)
|
|
})
|
|
}
|