feat: harden the hosted content-commit + login paths - #23
Open
euoia wants to merge 1 commit into
Open
Conversation
Phase 3 prep for internet-facing per-site instances (the editor holds a write credential). Commit path (server/api/publish.js, git.js): - createGitClient applies hardened git config to every invocation: core.hooksPath=/dev/null, core.fsmonitor=false, and disabled LFS smudge/clean/process filters — a content commit can't execute repo code from a crafted checkout. - commits pass --no-verify (belt-and-braces over hooksPath). - new assertNoStagedSymlinks() rejects a staged symlink under the content paths before commit (both commit sites). Login (server/index.js): - regenerate the session on successful login (session-fixation defence). - dedicated stricter limiter on /api/login (10/15min, prod-only; pass-through in dev) on top of the general /api/ limiter. Tests: tests/git-hardening.test.js — a hostile failing pre-commit hook neither runs nor blocks the commit; a staged symlink is rejected; regular files pass. auth + content-files suites still green. The UI already gates on /api/session (dashboard.js redirects to /login), so no client change was needed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Phase 3 prep for internet-facing per-site instances (the editor holds a write credential). Implements the small hardening gaps called out in
plans/2026-06-25-phase3-auth-hosting.md.Commit path (
server/api/publish.js,git.js)createGitClientnow applies hardened git config to every invocation:core.hooksPath=/dev/null,core.fsmonitor=false, disabled LFS smudge/clean/process filters — so staging/committing/checkout of content can't execute arbitrary scripts from a crafted checkout.--no-verify(belt-and-braces overhooksPath).assertNoStagedSymlinks()rejects a staged symlink under the content paths before commit, wired into both commit sites.Login (
server/index.js)/api/login(10 / 15 min, prod-only; pass-through in dev) on top of the general/api/limiter.Verification
tests/git-hardening.test.js: a hostile failingpre-commithook neither runs nor blocks the commit; a staged symlink is rejected; regular files pass. 3/3 green.auth(5/5) andcontent-files(10/10) suites still green; changed modules import cleanly./api/session(dashboard.jsredirects to/login), so no client change was needed.