cgalo5758
b245bdb0a9
Remediate six confirmed security issues: deployment-only config keys, bounded provider responses, short-lived registration sessions, private init file mode, FedWiki workflow authorization, and switch preview gates. - Add DeploymentOnly config key declaration; refuse runtime overrides for keys that decide where secrets are sent - Create httplimit package; bound all provider response reads at 8 MiB - Set fifteen-minute deadline on /register sessions - Write mc-config.yaml with 0600 permissions - Derive FedWiki workflow IDs from site IDs; re-authorize sites before mutating activities - Apply switch authorization gates to the proration preview
29 lines
900 B
Go
29 lines
900 B
Go
// SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Commercial
|
|
// SPDX-FileCopyrightText: 2025-2026 Christian Galo
|
|
|
|
package cmd
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
)
|
|
|
|
// The scaffold is the file the deployment's credentials are entered into
|
|
// (db-dsn, valkey-password, the OIDC and Temporal client secrets), so init
|
|
// creates it private (console-init: "The file SHALL be created with mode
|
|
// 0600"; security-audit-remediation-3). Under a 022 umask 0644 would have
|
|
// left it readable by every local user.
|
|
func TestInitWritesTheConfigFilePrivate(t *testing.T) {
|
|
dir := filepath.Join(t.TempDir(), "instance")
|
|
initCmd.Run(initCmd, []string{dir})
|
|
|
|
info, err := os.Stat(filepath.Join(dir, "mc-config.yaml"))
|
|
if err != nil {
|
|
t.Fatalf("init wrote no mc-config.yaml: %v", err)
|
|
}
|
|
if mode := info.Mode().Perm(); mode != 0o600 {
|
|
t.Fatalf("mc-config.yaml mode = %o, want 600", mode)
|
|
}
|
|
}
|