mirror of
https://github.com/snapotter-hq/SnapOtter.git
synced 2026-08-03 07:46:42 +02:00
SnapOtterandGitHub
079fcd2631
Follow-up to a full re-audit of the 2.0 tree. Most prior findings were already fixed; this closes the ones that were not: - SAML assertion replay: validateInResponseTo ifPresent plus a Redis-backed CacheProvider, so a captured signed assertion cannot be replayed. ifPresent keeps IdP-initiated SSO working. - MFA login challenge burned after 5 wrong TOTP codes. - api_keys.key_prefix indexed; the per-request lookup was a full table scan. - MAX_AI_JOBS_PER_USER caps a user's in-flight single-file AI jobs (the AI pool runs at concurrency 1). Batch and pipeline AI stay uncapped. - MAX_WORKSPACE_SIZE_GB enforced instead of being dead config. - SUBPROCESS_MEMORY_LIMIT_MB (default off) for the native media and doc engines; not applied to the AI sidecar. - SVG sanitizer closes unquoted and whitespace-prefixed javascript: hrefs and the animateTransform/animateMotion/handler/mpath elements. - Windows-style paths stripped from error output to match the Sentry scrubber. - Postgres and Redis compose services get cap_drop plus pids_limit and cpus. - .env.example ships MAX_SVG_SIZE_MB=50 (0 disabled the cap). Adds security-focused unit and integration tests. typecheck, biome, and the full unit and integration suites pass.
47 lines
2.0 KiB
TypeScript
47 lines
2.0 KiB
TypeScript
import { describe, expect, it } from "vitest";
|
|
|
|
const { makeRedisSamlCacheProvider } = await import("../../../apps/api/src/lib/saml-cache.js");
|
|
const { sharedRedis } = await import("../../../apps/api/src/jobs/connection.js");
|
|
|
|
// Verifies the InResponseTo replay-prevention primitive behind SAML hardening:
|
|
// a request ID can be stored once, is rejected on a duplicate save (the replay
|
|
// signal node-saml keys off), and disappears after it is consumed.
|
|
describe("SAML Redis cache provider (InResponseTo replay protection)", () => {
|
|
it("stores a request id once, rejects a duplicate save, and consumes on remove", async () => {
|
|
const provider = makeRedisSamlCacheProvider();
|
|
const key = `test-${Math.random().toString(36).slice(2)}`;
|
|
|
|
const first = await provider.saveAsync(key, key);
|
|
expect(first).not.toBeNull();
|
|
expect(first?.value).toBe(key);
|
|
|
|
// A replayed response reuses the same InResponseTo id: the save must fail.
|
|
const duplicate = await provider.saveAsync(key, key);
|
|
expect(duplicate).toBeNull();
|
|
|
|
expect(await provider.getAsync(key)).toBe(key);
|
|
|
|
// Consuming (as node-saml does on a valid first use) removes it, so a later
|
|
// replay finds nothing and is rejected.
|
|
expect(await provider.removeAsync(key)).toBe(key);
|
|
expect(await provider.getAsync(key)).toBeNull();
|
|
expect(await provider.removeAsync(key)).toBeNull();
|
|
});
|
|
|
|
it("returns null from removeAsync when given a null key", async () => {
|
|
const provider = makeRedisSamlCacheProvider();
|
|
expect(await provider.removeAsync(null)).toBeNull();
|
|
});
|
|
|
|
it("honors the TTL so stale request ids self-expire", async () => {
|
|
const provider = makeRedisSamlCacheProvider(1); // 1 second
|
|
const key = `test-ttl-${Math.random().toString(36).slice(2)}`;
|
|
await provider.saveAsync(key, key);
|
|
// Confirm the TTL was actually set on the namespaced key (not persisted).
|
|
const ttl = await sharedRedis().ttl(`saml:req:${key}`);
|
|
expect(ttl).toBeGreaterThan(0);
|
|
expect(ttl).toBeLessThanOrEqual(1);
|
|
await provider.removeAsync(key);
|
|
});
|
|
});
|