fix: cora scan security findings (traversal, byte-slice panic, header inject, orphan file)

[ajianaz]

Summary

Addresses the valid security/robustness findings from a cora scan (v0.6.2) of the codebase. Triaged 59 findings down to 4 real issues; false positives left untouched.

Fixed

File	Issue	Fix
storage.rs	Path traversal check used naive contains("..") — both weaker than needed and rejects legit filenames with ..	Check Path components (ParentDir / absolute) instead
oauth.rs (×2)	&body[..200] panics on multibyte UTF-8 in provider error bodies	Char-bounded preview() helper
attachment_routes.rs	Content-Disposition: inline; filename="\{user_input\}" — CR/LF → header injection, " → broken header	sanitize_filename() (neutralize CR/LF/quote/ctrl, fallback to download)
attachment_routes.rs	File saved to disk before DB insert; if insert fails → orphaned file leak	Cleanup file on DB-insert failure

Triaged as false positives (not changed)

• store.rs MAX() in UPDATE — SQLite scalar max(a,b), tests pass
• store.rs ON CONFLICT — SQLite supports it, tests pass
• store.rs FTS5 p.rowid — valid implicit rowid column, tests pass
• auth_routes.rs cookie suffix injection — the = is included in the prefix check, which is the correct mitigation
• storage_key &id[..0] — empty slice is valid, no panic
• Dockerfile binary name — the binary is built as rungu ([[bin]] name = "rungu")

Out of scope (separate concerns)

• Frontend (web/) XSS/path-traversal findings — different layer, separate PR
• lib.rs PG multi-statement migration — pre-existing infra, affects feat: perf + correctness fixes (user_voted N+1, rate limiting, pg FTS, slug cache) #94's PG FTS; tracked there
• Remaining MINOR best-practice notes

Checklist

• cargo fmt --check
• cargo clippy -D warnings
• cargo test --workspace (91 pass, +2 new)
• cora review (0 issues)

[github-actions]

🔍 Cora AI Code Review

⚠️ Review recommended — warnings found.

🟡 Warning (1)

• unknown:? — Cora AI review could not complete: LLM API returned status 401: {"error":"Insufficient balance"}
  . Review was skipped; no code quality issues were found by the automated check.

---

Review powered by cora-cli · BYOK · MIT