fix: patch multiple zero-day security vulnerabilities

[ryokun6]

Security Audit & Fixes

Full security audit of the API surface uncovered 12 vulnerabilities across authentication, authorization, input validation, and network-layer protections. This PR fixes all of them.

Critical Fixes

Severity	Vulnerability	File(s)	Fix
Critical	Token verify cookie injection — attacker can set a cookie with a victim's username paired with their own token by sending only body.username without body.token, bypassing validation	api/auth/token/verify.ts	Always validate the username+token pair against Redis before setting the auth cookie
Critical	Unauthenticated data destruction — clear-cached-data action on songs deletes translations/furigana/soramimi without any auth check	api/songs/[id].ts	Require authentication and canModifySong permission check
High	Admin privilege squatting — username ryo (hardcoded admin) could be registered by any user on a fresh deployment	api/auth/register.ts	Reserve ryo, admin, system, moderator, mod from public registration
High	Private room IDOR — handleGetRooms trusts unauthenticated ?username= query param to filter private rooms	api/rooms/_helpers/_rooms.ts	Use authenticated username instead of query parameter

Medium Fixes

Severity	Vulnerability	File(s)	Fix
Medium	Prototype pollution — client-supplied systemState spread with ... can inject __proto__/constructor keys	api/chat.ts	Filter dangerous keys before spreading
Medium	Bulk messages missing access control — legacy handleGetBulkMessages skips private room membership check	api/rooms/_helpers/_messages.ts	Add room type + membership validation
Medium	Password change with expired token — allowExpiredAuth: true lets stolen grace tokens set new passwords	api/auth/password/set.ts	Set allowExpiredAuth: false
Medium	Unbounded applet content — no max size on shared applet content field enables Redis memory DoS	api/share-applet.ts	Cap at 512KB + field length limits
Medium	Decompression bomb — gzip payloads in bulk song import have no output size limit	api/songs/index.ts	Add 5MB decompression limit
Medium	Unbounded bulk import — no limit on songs array size	api/songs/index.ts	Cap at 500 items

Low / Hardening Fixes

Severity	Vulnerability	File(s)	Fix
Low	DNS rebinding TOCTOU — validate-then-fetch pattern allows DNS to change between check and connect	api/_utils/_ssrf.ts	Double-resolve and re-validate addresses before fetch
Low	CORS wildcard + credentials footgun — API_ALLOWED_ORIGINS=* with credentials is insecure	api/_utils/_cors.ts	Add warning log; ensure reflect-origin mode (never literal *)
Low	User enumeration via registration — distinct error for existing users	api/auth/register.ts	Unify error message
Low	Missing member validation — private room member names not validated	api/rooms/index.ts	Validate with assertValidUsername

Testing

• bun run build — clean compilation
• bun run test:unit — all 130 tests pass (0 failures)
• No behavioral changes to existing features; all fixes are defensive guards added to existing code paths

  

[ryos-deploy]

The preview deployment for ryos-dev is ready. 🟢

Open Preview | Open Build Logs | Open Application Logs

Last updated at: 2026-03-30 08:07:39 CET