OWASP Top 10 hardening — injection, auth, headers, logging, passwords#53
Merged
OWASP Top 10 hardening — injection, auth, headers, logging, passwords#53
Conversation
Restrict ffmpeg/ffprobe to safe protocols (http,https,tcp,udp,rtp,rtmp,pipe) via -protocol_whitelist flag on all invocations. Validate URL schemes (http/https only) at input time on M3U, XC, and EPG source endpoints. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Rate limit /api/auth/login and /api/auth/dispatcharr/login to 5 requests per minute per IP. Uses slowapi with in-memory backend. Includes client IP in login failure logs for forensics. Disabled in tests via env var. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…5/A09) - Security headers middleware: X-Frame-Options DENY, X-Content-Type-Options nosniff, Referrer-Policy strict-origin-when-cross-origin - CORS: replace wildcard methods/headers with explicit allow lists - Global HTTPException handler scrubs 500 response bodies to generic message - Validation error handler redacts Authorization/Cookie headers and auth endpoint request bodies from logs - Register slowapi rate limit handler Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Drop composition rules (uppercase/lowercase/number) per NIST guidance. Replace 33-word inline list with 10k common passwords file. Apply uniform 8-char minimum to admin-created users. Remove frontend composition checks from SetupPage and ResetPasswordPage. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add os.path.resolve() check to verify extracted zip paths stay within CONFIG_DIR. Defense-in-depth alongside existing '..' and absolute path checks — current code already uses zf.read()+write_bytes() not extractall(). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Assert generic 'Internal server error' on 500 responses (scrubbed) - Remove composition rule tests, add NIST-aligned password tests - Disable rate limiting in test environment - Update backup test expectations Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Channel names from Dispatcharr include the channel number (e.g., "535 | Willow 2"). The normalizer kept the digits, producing "535willow2" instead of "willow2", guaranteeing zero EPG matches. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Security hardening based on OWASP Top 10 evaluation. Addresses findings across 6 categories:
-protocol_whiteliston all invocations, URL scheme validation (http/https only) on M3U/XC/EPG input endpointsCommits
a6ba953ffmpeg protocol whitelist + URL scheme validationaddc6b3Login rate limiting with slowapidd16f55Security headers, CORS, 500 scrubbing, log redaction89e7f93NIST 800-63B password policy31b95b6Zip backup path canonicalization4927aedTest updatesTest plan
file://,data://,gopher://URLs rejected with 400 at M3U/EPG endpoints🤖 Generated with Claude Code