clawbot
60786c5019
All checks were successful
check / check (push) Successful in 4s
## Security Hardening This PR implements three security hardening issues: ### CSRF Protection (closes #35) - Session-based CSRF tokens with cryptographically random 256-bit generation - Constant-time token comparison to prevent timing attacks - CSRF middleware applied to `/pages`, `/sources`, `/source`, and `/user` routes - Hidden `csrf_token` field added to all 12+ POST forms in templates - Excluded from `/webhook` (inbound webhook POSTs) and `/api` (stateless API) ### SSRF Prevention (closes #36) - `ValidateTargetURL()` blocks private/reserved IP ranges at target creation time - Blocked ranges: `127.0.0.0/8`, `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`, `169.254.0.0/16`, `::1`, `fc00::/7`, `fe80::/10`, plus multicast, reserved, test-net, and CGN ranges - SSRF-safe HTTP transport with custom `DialContext` in the delivery engine for defense-in-depth (prevents DNS rebinding attacks) - Only `http` and `https` schemes allowed ### Login Rate Limiting (closes #37) - Per-IP rate limiter using `golang.org/x/time/rate` - 5 attempts per minute per IP on `POST /pages/login` - GET requests (form rendering) pass through unaffected - Automatic cleanup of stale per-IP limiter entries every 5 minutes - `X-Forwarded-For` and `X-Real-IP` header support for reverse proxies ### Files Changed **New files:** - `internal/middleware/csrf.go` + tests — CSRF middleware - `internal/middleware/ratelimit.go` + tests — Login rate limiter - `internal/delivery/ssrf.go` + tests — SSRF validation + safe transport **Modified files:** - `internal/server/routes.go` — Wire CSRF and rate limit middleware - `internal/handlers/handlers.go` — Inject CSRF token into template data - `internal/handlers/source_management.go` — SSRF validation on target creation - `internal/delivery/engine.go` — SSRF-safe HTTP transport for production - All form templates — Added hidden `csrf_token` fields - `README.md` — Updated Security section and TODO checklist `docker build .` passes (lint + tests + build). Co-authored-by: clawbot <clawbot@noreply.git.eeqj.de> Co-authored-by: clawbot <clawbot@eeqj.de> Co-authored-by: Jeffrey Paul <sneak@noreply.example.org> Reviewed-on: #42 Co-authored-by: clawbot <clawbot@noreply.example.org> Co-committed-by: clawbot <clawbot@noreply.example.org>
68 lines
2.5 KiB
Modula-2
68 lines
2.5 KiB
Modula-2
module sneak.berlin/go/webhooker
|
|
|
|
go 1.24.0
|
|
|
|
toolchain go1.24.1
|
|
|
|
require (
|
|
github.com/99designs/basicauth-go v0.0.0-20230316000542-bf6f9cbbf0f8
|
|
github.com/getsentry/sentry-go v0.25.0
|
|
github.com/go-chi/chi v1.5.5
|
|
github.com/go-chi/cors v1.2.1
|
|
github.com/go-chi/httprate v0.15.0
|
|
github.com/google/uuid v1.6.0
|
|
github.com/gorilla/csrf v1.7.3
|
|
github.com/gorilla/sessions v1.4.0
|
|
github.com/joho/godotenv v1.5.1
|
|
github.com/prometheus/client_golang v1.18.0
|
|
github.com/slok/go-http-metrics v0.11.0
|
|
github.com/stretchr/testify v1.8.4
|
|
go.uber.org/fx v1.20.1
|
|
golang.org/x/crypto v0.38.0
|
|
gorm.io/driver/sqlite v1.5.4
|
|
gorm.io/gorm v1.25.5
|
|
modernc.org/sqlite v1.28.0
|
|
)
|
|
|
|
require (
|
|
github.com/beorn7/perks v1.0.1 // indirect
|
|
github.com/cespare/xxhash/v2 v2.2.0 // indirect
|
|
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
|
|
github.com/dustin/go-humanize v1.0.1 // indirect
|
|
github.com/gorilla/securecookie v1.1.2 // indirect
|
|
github.com/jinzhu/inflection v1.0.0 // indirect
|
|
github.com/jinzhu/now v1.1.5 // indirect
|
|
github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
|
|
github.com/klauspost/cpuid/v2 v2.2.10 // indirect
|
|
github.com/kr/text v0.2.0 // indirect
|
|
github.com/mattn/go-isatty v0.0.20 // indirect
|
|
github.com/mattn/go-sqlite3 v1.14.17 // indirect
|
|
github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0 // indirect
|
|
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
|
|
github.com/prometheus/client_model v0.5.0 // indirect
|
|
github.com/prometheus/common v0.45.0 // indirect
|
|
github.com/prometheus/procfs v0.12.0 // indirect
|
|
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
|
|
github.com/zeebo/xxh3 v1.0.2 // indirect
|
|
go.uber.org/atomic v1.9.0 // indirect
|
|
go.uber.org/dig v1.17.0 // indirect
|
|
go.uber.org/multierr v1.9.0 // indirect
|
|
go.uber.org/zap v1.23.0 // indirect
|
|
golang.org/x/mod v0.17.0 // indirect
|
|
golang.org/x/sync v0.14.0 // indirect
|
|
golang.org/x/sys v0.33.0 // indirect
|
|
golang.org/x/text v0.25.0 // indirect
|
|
golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d // indirect
|
|
google.golang.org/protobuf v1.31.0 // indirect
|
|
gopkg.in/yaml.v3 v3.0.1 // indirect
|
|
lukechampine.com/uint128 v1.2.0 // indirect
|
|
modernc.org/cc/v3 v3.40.0 // indirect
|
|
modernc.org/ccgo/v3 v3.16.13 // indirect
|
|
modernc.org/libc v1.29.0 // indirect
|
|
modernc.org/mathutil v1.6.0 // indirect
|
|
modernc.org/memory v1.7.2 // indirect
|
|
modernc.org/opt v0.1.3 // indirect
|
|
modernc.org/strutil v1.1.3 // indirect
|
|
modernc.org/token v1.0.1 // indirect
|
|
)
|