mirror of
https://github.com/screentinker/screentinker.git
synced 2026-08-13 22:03:13 -06:00
d4b8d7dad4
A second review pass, run against the previous commit, found four blockers — two of
them introduced by the fixes in that commit. It also confirmed the original account
takeover is closed: a hostile IdP with real TLS, discovery, JWKS and RS256 driving the
real routers now stops at domain_not_allowed, and all 16 bypass variants are refused.
DOMAIN OWNERSHIP (the root cause, not the symptom)
A claimed domain used to mean "nobody else claimed it". It now means the organization
published a record in that domain's own DNS — TXT or CNAME, at a dedicated
_screentinker-verify name rather than the apex, where an edit would sit beside SPF.
- an unverified domain routes NOBODY and cannot be asserted; it reserves the name
- an unverified claim LAPSES after 8 hours, so a domain cannot be held against its
real owner, and lapsing rotates the token so a record left over from an abandoned
attempt cannot satisfy a later claim
- a verified domain never expires — re-proving on a timer would log a customer out
over a DNS edit made months later
- routing and confinement read the VERIFIED set only, never the typed column
- configuring SSO now requires a verified email address
- platform admins are emailed when a domain is claimed; nothing is ever sent to the
claimed domain, which would let any tenant make this product email third parties
Instance-wide providers are exempt from all of it: they are the operator's own
configuration and keep the trust they have always had.
BLOCKERS FROM THE REVIEW
- two unauthenticated remote crashes, both one request, both "async handler throws
before its try": `Cookie: st_oidc_tx=%` (unguarded decodeURIComponent) and the
fail-closed secret added last commit, which turned a JWT_SECRET rotation into a
permanent crash loop. Fixed the CLASS with asyncRoute() rather than the instances.
- the SSRF guard was bypassable via IPv4-mapped IPv6 ([::ffff:127.0.0.1]) and also
refused every host beginning "fc"/"fd" (fcm.googleapis.com). Addresses are now
parsed and compared by RANGE. 42 cases verified.
- the takeover fix had NO test — the test named after it asserted two struct fields
and passed with the guard deleted. The decision is now a pure function and four
mutations were confirmed to turn the suite red.
- the PUT path never received the TOCTOU fix, so two orgs could end up holding one
domain and forEmail handed routing to the attacker's older row.
ALSO
- linking compared slugs, so an org could never rotate its own IdP, and fell open on
an empty auth_provider. It now asks which ORGANIZATION owns the slug.
- an account stranded by a deleted provider can be reclaimed by password reset —
proof of the mailbox, which is stronger than the IdP assertion that created it.
- /sso/claim accepted a pre-TOTP mfa_pending token and returned the full user row;
it now takes a purpose-built 120s claim token with a pinned algorithm and typ.
- the rate limiter keyed on a caller-controlled path, so a trailing slash bought a
fresh bucket — a real login brute-force bypass.
- domain_not_allowed and account_exists_other_provider rendered as "please try
again", advice that can never work.
- malformed asserted addresses are refused rather than trimmed into shape.
- dead config (microsoftTenantId defaulted to 'common', which the provider code now
refuses) and the orphaned google-auth-library dependency removed.
1591 tests pass. Domain lifecycle verified end to end against a running server.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Bvjey4FNam49MN7ybjcq6A
|
||
|---|---|---|
| .. | ||
| agency-layouts.js | ||
| agency-targets.js | ||
| apk-cache.js | ||
| apk-signature.js | ||
| app-settings.js | ||
| billing-token.js | ||
| billing.js | ||
| bounded-snapshot-store.js | ||
| branding.js | ||
| brightsign-package.js | ||
| brightsign-snapshot-queue.js | ||
| brightsign-update.js | ||
| chunked-prune.js | ||
| command-queue.js | ||
| content-ack-limiter.js | ||
| content-ingest.js | ||
| device-identity.js | ||
| device-sanitize.js | ||
| device-settings.js | ||
| device-timezone.js | ||
| domain-verify.js | ||
| emailVerify.js | ||
| flap-limiter.js | ||
| ghcr-check.js | ||
| image-gen.js | ||
| incident-classify.js | ||
| item-duration.js | ||
| limiter-telemetry.js | ||
| liveness.js | ||
| log-coalescer.js | ||
| login-lockout.js | ||
| media-mute.js | ||
| media-orientation.js | ||
| media-tools.js | ||
| numeric-code.js | ||
| oidc-providers.js | ||
| oidc.js | ||
| orientation-style.js | ||
| ota-breaker.js | ||
| ota-download-guard.js | ||
| pair-lockout.js | ||
| parse-size.js | ||
| passwordReset.js | ||
| permissions.js | ||
| player-cache-policy.js | ||
| player-capabilities.js | ||
| player-media-health.js | ||
| public-email-domains.js | ||
| reconnect-throttle.js | ||
| recovery-grant.js | ||
| rolling-counter.js | ||
| safe-socket.js | ||
| schedule-eval.js | ||
| schema-check.js | ||
| secretbox.js | ||
| session-settle.js | ||
| settings-pin.js | ||
| socket-rooms.js | ||
| ssrf-guard.js | ||
| status-log-writer.js | ||
| sync-backend.js | ||
| tcp-keepalive.js | ||
| tenancy.js | ||
| tenant-cascade-migration.js | ||
| thumbnail-backfill.js | ||
| totp-lockout.js | ||
| totp.js | ||
| transition-bundle.js | ||
| transition-config.js | ||
| upload-sniff.js | ||
| user-deletion.js | ||
| wall-geometry.js | ||
| wgt-cache.js | ||
| zone-validate.js | ||