Files

T

cgalo5758 b245bdb0a9 Fix security audit findings from 2026-09-21 scan

Remediate six confirmed security issues: deployment-only config keys,
bounded provider responses, short-lived registration sessions, private
init file mode, FedWiki workflow authorization, and switch preview
gates.

- Add DeploymentOnly config key declaration; refuse runtime overrides
  for keys that decide where secrets are sent
- Create httplimit package; bound all provider response reads at 8 MiB
- Set fifteen-minute deadline on /register sessions
- Write mc-config.yaml with 0600 permissions
- Derive FedWiki workflow IDs from site IDs; re-authorize sites before
  mutating activities
- Apply switch authorization gates to the proration preview

2026-09-21 13:57:57 -05:00

1.5 KiB

Raw Blame History

provider-http-responses Specification

Purpose

TBD - created by archiving change security-audit-remediation-3. Update Purpose after archive.

Requirements

Requirement: Provider responses are read within a byte bound

An outbound HTTP client SHALL read a configured provider's response body (FarmManager, Discourse, the Temporal OAuth token endpoint, and any client added later) through one shared reader that stops at a declared byte bound and refuses the response with an error naming the bound and the provider when the body exceeds it. The body SHALL NOT be silently truncated: a bounded response is either complete or refused. The default bound SHALL be a named constant (8 MiB) that a client MAY lower for a known-small response.

Scenario: A response within the bound is read whole

WHEN a provider answers with a body smaller than the bound
THEN the client SHALL receive the complete body

Scenario: A response beyond the bound is refused

WHEN a provider streams a body larger than the bound
THEN the client SHALL stop reading at the bound, close the body, and return an error naming the bound and the provider
AND the process's memory use for that response SHALL NOT exceed the bound

Scenario: Error text is bounded before it is quoted

WHEN a provider answers a non-success status with a large body
THEN the error the client reports SHALL quote at most the bounded excerpt the client already limits today

1.5 KiB Raw Blame History