From c2a7c28eecde7115462019a43fc8e6ec8a8adb65 Mon Sep 17 00:00:00 2001 From: Oliver Kieselbach Date: Thu, 5 Feb 2026 22:12:45 +0100 Subject: [PATCH] more hardenings --- .../Functions/SignalRNegotiateFunction.cs | 6 +++--- .../Security/HardwareWhitelistValidator.cs | 11 ++++++++++- 2 files changed, 13 insertions(+), 4 deletions(-) diff --git a/src/Backend/AutopilotMonitor.Functions/Functions/SignalRNegotiateFunction.cs b/src/Backend/AutopilotMonitor.Functions/Functions/SignalRNegotiateFunction.cs index d390e3f8..c3e1a179 100644 --- a/src/Backend/AutopilotMonitor.Functions/Functions/SignalRNegotiateFunction.cs +++ b/src/Backend/AutopilotMonitor.Functions/Functions/SignalRNegotiateFunction.cs @@ -17,7 +17,7 @@ namespace AutopilotMonitor.Functions.Functions } [Function("negotiate")] - public HttpResponseData Negotiate( + public async Task Negotiate( [HttpTrigger(AuthorizationLevel.Anonymous, "post", Route = "realtime/negotiate")] HttpRequestData req, [SignalRConnectionInfoInput(HubName = "autopilotmonitor")] SignalRConnectionInfo connectionInfo) { @@ -43,7 +43,7 @@ namespace AutopilotMonitor.Functions.Functions { _logger.LogWarning("Unauthenticated SignalR negotiate attempt"); var unauthorizedResponse = req.CreateResponse(HttpStatusCode.Unauthorized); - unauthorizedResponse.WriteAsJsonAsync(new { success = false, message = "Authentication required" }); + await unauthorizedResponse.WriteAsJsonAsync(new { success = false, message = "Authentication required" }); return unauthorizedResponse; } @@ -51,7 +51,7 @@ namespace AutopilotMonitor.Functions.Functions _logger.LogInformation($"SignalR connection negotiated for user: {userEmail}"); var response = req.CreateResponse(HttpStatusCode.OK); - response.WriteAsJsonAsync(connectionInfo); + await response.WriteAsJsonAsync(connectionInfo); return response; } diff --git a/src/Backend/AutopilotMonitor.Functions/Security/HardwareWhitelistValidator.cs b/src/Backend/AutopilotMonitor.Functions/Security/HardwareWhitelistValidator.cs index 73f60c03..0ef18ad4 100644 --- a/src/Backend/AutopilotMonitor.Functions/Security/HardwareWhitelistValidator.cs +++ b/src/Backend/AutopilotMonitor.Functions/Security/HardwareWhitelistValidator.cs @@ -97,7 +97,16 @@ namespace AutopilotMonitor.Functions.Security .Replace("\\*", ".*") .Replace("\\?", ".") + "$"; - return Regex.IsMatch(text, regexPattern, RegexOptions.IgnoreCase); + try + { + // Use timeout to prevent ReDoS attacks with pathological input + return Regex.IsMatch(text, regexPattern, RegexOptions.IgnoreCase, TimeSpan.FromMilliseconds(100)); + } + catch (RegexMatchTimeoutException) + { + // Timeout indicates potential ReDoS attempt - treat as non-match + return false; + } } }