mixandClaude Opus 5.5
b2fbe91de9
Stage 3, step 2. Reviewed by Fable (read-only), fixed by Sonnet with a
failing test before each fix, checked by Opus. No Critical or High
finding: route authorization, tenant isolation by id, the /server/
subtree guard, output encoding and the origin check were found sound.
Fixed
- M1: a session was keyed by user name and had no link to the user. A
deleted or renamed user's cookie stayed alive (renewed on every hit,
before the user was looked up) and became a session of whoever was
later created under that name, with that account's role. The
baseline now has sessions.user_id REFERENCES users(id) ON DELETE
CASCADE; the principal is resolved by id and a session is renewed
only after its user was found. RenameSession is gone.
- M2: any user's password change deleted every other user's sessions.
It ends that user's other sessions only.
- L1: a password set on the user form ends that user's sessions (an
administrator editing their own account keeps the current one).
- L2: store, saslpasswd2 and Postfix reload errors were shown verbatim
on the application form, the inbound upstream / recipients forms and
the limit recalculation - pages a domain administrator reaches.
Validation errors (app.ValidationError, inbound.ValidationError,
store.ErrNotAutoRateLimit) keep their text; anything else is logged
and shown as "Could not save ... Check the logs and try again."
- L3: store.ListDMARCReports treated an empty domain list as "all". It
takes a scope now (AllDomains or a list; an empty list is no rows),
and the DMARC hub is open to the domain role as the plan says: the
reports of the assigned domains, without the instance-wide ingest
box. The menu entry was already shown to them and led to a 404.
- I1: /static/ answered with a listing of the embedded assets. A path
that is not a known asset is a 404.
Consequences
- The global DMARC hub lists reports of domains that were deleted
since, too.
- dev/migrate1x (not in the tree) no longer carries sessions over:
everyone signs in again after the transfer.
- docs/schema-migrations.md: the sessions row.
Recorded, not changed - for the owner:
- L4: the report-address select names the followed user and their
address to every administrator of the domain, by default the global
administrator's login name. The plan asks for it.
- L5: a delegated inbound upstream may be any host and port, loopback
and private ranges included - within the trusted-operator model; to
be listed among the accepted risks in security.md.
- L6: Account's profile is saved without the password; becomes a
requirement once password-reset mails to users.email.
- Still echoing an error's text: backup and domain import (global
only), the domain form's validation messages.
Not checked by the review: anything needing the container (e2e, real
Postfix / DNS), CSP behaviour in a live browser.
go test -count=1 ./internal/web/... ./internal/store/... ./internal/app/...
./internal/inbound/... ./internal/dmarc/... ./cmd/panel
ok (all eleven packages; dev/migrate1x also ok)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
66 lines
2.4 KiB
Go
66 lines
2.4 KiB
Go
package view
|
|
|
|
import (
|
|
"crypto/sha256"
|
|
"encoding/hex"
|
|
"io/fs"
|
|
"net/http"
|
|
"path"
|
|
)
|
|
|
|
// staticETags maps each /static/ URL path to a strong ETag over the asset's
|
|
// bytes, computed once at startup from the embedded FS.
|
|
//
|
|
// The assets are baked into the binary, so their FS modification times are the
|
|
// zero value and http.FileServer sends no Last-Modified. Without an ETag either,
|
|
// a response carries no validator at all and the browser is free to guess how
|
|
// long to keep it — which is how a replaced favicon keeps showing the old mark
|
|
// long after a deploy. Hashing the content gives every asset a validator that
|
|
// changes exactly when the asset does.
|
|
var staticETags = buildStaticETags()
|
|
|
|
func buildStaticETags() map[string]string {
|
|
etags := make(map[string]string)
|
|
// An error here would mean the embed directive and this walk disagree, which
|
|
// is a build-time defect rather than a runtime condition; the assets still
|
|
// serve correctly without a validator, so skip what can't be read.
|
|
_ = fs.WalkDir(assetsFS, "static", func(name string, d fs.DirEntry, err error) error {
|
|
if err != nil || d.IsDir() {
|
|
return nil
|
|
}
|
|
b, err := fs.ReadFile(assetsFS, name)
|
|
if err != nil {
|
|
return nil
|
|
}
|
|
sum := sha256.Sum256(b)
|
|
etags["/"+name] = `"` + hex.EncodeToString(sum[:16]) + `"`
|
|
return nil
|
|
})
|
|
return etags
|
|
}
|
|
|
|
// StaticHandler serves the embedded assets under /static/ with a content ETag.
|
|
// A path that is not one of those assets — the folder itself included — is a
|
|
// 404: the file server would otherwise answer the folder with a listing of
|
|
// everything the binary embeds.
|
|
//
|
|
// Cache-Control is no-cache rather than a max-age: it lets the browser keep the
|
|
// copy but requires it to revalidate, so an asset that changed is picked up on
|
|
// the next page load while an unchanged one costs a 304 with no body. For a
|
|
// handful of small files on a single-operator panel that trade is the right way
|
|
// round — correctness after a deploy matters more than saving the round trip.
|
|
// http.ServeContent answers the conditional request from the ETag we set here.
|
|
func StaticHandler() http.Handler {
|
|
files := http.FileServer(http.FS(assetsFS))
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
etag, ok := staticETags[path.Clean(r.URL.Path)]
|
|
if !ok {
|
|
http.NotFound(w, r)
|
|
return
|
|
}
|
|
w.Header().Set("ETag", etag)
|
|
w.Header().Set("Cache-Control", "no-cache")
|
|
files.ServeHTTP(w, r)
|
|
})
|
|
}
|