From 31820b5c2382e128703774b36c93c8c5595413c8 Mon Sep 17 00:00:00 2001 From: JOY <5027251+JOY@users.noreply.github.com> Date: Sun, 13 Sep 2026 17:24:16 +0700 Subject: [PATCH] docs(audit): close SEC-08, SEC-09 and SEC-26, and record how they were verified Marks the three IDs Done and records what actually shipped, in the dependency order that mattered: SEC-26 first, because the other two key on a client address that was forgeable until it landed. SEC-26 (PR #13). ServerConfig gains trustedProxies and trustedPlatform, applied in NewServer before any middleware. An unparseable CIDR fails startup rather than quietly dropping the trust boundary. The default is the loopback, RFC1918, IPv6 unique-local and link-local ranges rather than Gin's trust-everything default, and trustedPlatform defaults to empty on purpose - an edge that appends instead of overwriting would hand the header back to the caller. SEC-09 (PR #13). isCredentialLocked now takes the client address and applies two windows: principal-and-address for one source grinding on one account, and address-across-all-principals for credential stuffing. The four existing lockout tests failed when the key changed, because they seeded credential logs without a client address - they encoded the vulnerable semantics. That failure is the evidence the fix is real. SEC-08 (PR #14). Six public routes limited, with the channel webhooks, websockets, HMAC webhooks and the whole dashboard deliberately exempt; a test fires 1000 requests at five of those routes and fails on any 429, because a platform that gets throttled on its webhook eventually disables the delivery and takes a channel offline. Also recorded, because leaving them out would make the document read better than the work was: - Retry-After shipped as int(seconds)+1 at first, which returns 61 for a 60 second window whenever the clock has not ticked between requests. My own test caught it. - The limiter could not be validated under -race. This repository builds with CGO disabled and go test -race requires cgo. The concurrency test still has teeth, since an unguarded concurrent map write panics rather than merely miscounting, but it is not a substitute for the race detector. - SEC-26, SEC-09 and SEC-08 have not been ported upstream. They cannot be replayed the way the upload fix was: config.go on dev carries fork-only fields, and server.go on dev already contains the storage hardening still sitting in the open upstream PR #40. - A second git incident. A file showed as modified in git status while git diff was empty - a stat-cache artifact after gofmt then restore - and it blocked a fast-forward. Resolved by proving the content identical with git diff --exit-code HEAD, then git add --renormalize, then confirming the staged diff was empty before continuing. Remaining count moves from 89 to 86. Every declared number in the document is cross-checked against the register tables by script across 18 sites plus the per-prefix stats table and its total row; the check passes. --- docs/CROVE_DESK_AUDIT.html | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/docs/CROVE_DESK_AUDIT.html b/docs/CROVE_DESK_AUDIT.html index a07af88b..c6ecea24 100644 --- a/docs/CROVE_DESK_AUDIT.html +++ b/docs/CROVE_DESK_AUDIT.html @@ -111,7 +111,7 @@

Crove Desk — Audit & Issue Register

- ✅ Round 5 — 2026-09-10 → 09-12: 21/115 ID đã đóng, 2 ID đóng một phần, 3 ID đã bác bỏ, 3 ID tôi tự cải chính, 1 ID mới (SEC-26). Upstream sync xong, main đã merge ngược vào dev, đã release v1.7.0-crove.1. Đọc mục này trước, register bên dưới giữ nguyên nội dung gốc để đối chiếu. + ✅ Round 5 — 2026-09-10 → 09-12: 24/115 ID đã đóng, 2 ID đóng một phần, 3 ID đã bác bỏ, 3 ID tôi tự cải chính. SEC-26 là ID mới của round này và đã đóng luôn. Upstream sync xong, main đã merge ngược vào dev, đã release v1.7.0-crove.1. Đọc mục này trước, register bên dưới giữ nguyên nội dung gốc để đối chiếu.