mirror of
https://github.com/sol1/rustguac.git
synced 2026-09-10 17:47:13 +00:00
Dave Kempe
9dbdc17843
Security audit (v1.6.1 cycle) findings: - Shadow tokens: each use now writes a shadow_used entry to token_audit_log with the connecting IP. Prior behaviour audited only the mint, so a leaked token could be replayed within its 10-minute TTL with no observable record. - OIDC groups claim: bound per-name length to 256 bytes (UTF-8 boundary preserved) and array size to 64. A misconfigured or compromised IdP could previously bloat the seen_groups table unbounded. - .cargo/audit.toml formalises the rsa (RUSTSEC-2023-0071) and rustls-pemfile (RUSTSEC-2025-0134) advisory ignores with rationale, replacing the inline --ignore flag in CI. New advisories on those crates will still surface. Small defence-in-depth: WebSocket Origin/Host compare is now case-insensitive (DNS is canonical) — previously exact-match. Test harness grows from 150 to 215 tests: - Pure-function regression coverage: OIDC groups cap, shadow-token validation matrix (owner/shadow/invalid/expired/IDOR), Vault path traversal, VDI username sanitization, recording-name hardening, JPEG magic bytes, Guacamole protocol parser adversarial cases (overflow length, UTF-8 split, malformed frames, buffer cap, streaming boundaries), Origin/Host matcher. - Async + in-memory state: SessionManager test helper bypassing disk/browser, owner/shadow validation end-to-end, mint prunes expired, shadow is session-scoped (IDOR guard), disconnect_viewer saturating decrement, seen_groups DB bounds, rate-limit layer burst -> 429 (proves tower_governor is actually applied). Behaviour-preserving refactors to support testing: check_share_token_match (from validate_share_token), is_jpeg_magic (from thumbnail PUT), origin_host_matches (from ws_handler CSWSH check).