ddidderr/lanspread
1
0
Fork 0
Code Issues 6 Pull Requests Actions Packages Projects Releases Wiki Activity

docs: record NET-05, Codex [7] and Codex [12] as fixed

Browse Source 
The ignore file listed these three findings as deliberately not fixed. A
cross-review of the three parallel fix branches showed that the second
branch had small, safe fixes for each, and they have now been ported onto
this branch (justfile `set export`, fallible `setup_done_path`, bounded
wire collection deserialization). Remove their "not fixed" rationales
and move them to the fixed row of the summary table so the file again
accounts for all 35 findings accurately.

Claude-Session: https://claude.ai/code/session_01QRkCv4a4GqkajyamxmbSuA
This commit is contained in:
ddidderr
2026-09-12 11:17:32 +02:00
parent 0fd368b6fa
commit 91cac53848
1 changed files with 9 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
SECURITY_FIXES_FABLE5.1_IGNORED.md
+9 -28
View File
@@ -12,7 +12,10 @@ Findings that only make sense against an internet-facing, multi-tenant threat
model are noted as such.
Fixed findings are documented in the individual commits on this branch and are
not repeated here.
not repeated here. After a cross-review of the three parallel fix branches,
NET-05, Codex [7] and Codex [12] were ported from the second branch and moved
from "not fixed" to "fixed" (see the commits touching `justfile`,
`state_paths.rs` and the bounded wire collections in `lanspread-proto`).
## Gemini audit
@@ -30,15 +33,6 @@ not repeated here.
- The "information harvesting" sub-point (display names, game lists, Call to
Play chat visible to any LAN client) is the product.
### NET-05 — Collection allocation before semantic validation
Response frames are capped at 8 MiB and are only read from identity-pinned peers
this node chose to pull from. Deserialising a few tens of megabytes of transient
structures before the bounds check rejects the payload is not a meaningful
resource attack for a desktop app, and the alternative (custom streaming
deserialisers for every collection) would complicate the strict wire codec for
no practical benefit.
### NET-06 — Unauthenticated chunk and Stream Install egress (informational)
By design; see NET-01.
@@ -145,12 +139,6 @@ simultaneous calls degrades the ticker for everyone but this is a prank that the
room can see and stop. Semantic caps on open calls per author would be a product
decision (how many calls may one person host?) rather than a security fix.
### [7] `justfile` recipe arguments are interpolated as shell code
The recipes are developer and catalog-operator tooling; the arguments are typed
by the operator on their own machine. Quoting every interpolation risks breaking
the build recipes for a threat that requires the operator to attack themselves.
### [8] Sybil peers can exhaust aggregate state and unbounded UI publication
Worst case is 64 authenticated identities each holding a 4 MiB author slice,
@@ -168,13 +156,6 @@ See SEC-IPC-01.
The monitored directory is the one the user selected on their own machine.
Budgeting traversal of the user's own files against the user is out of scope.
### [12] Public state helpers permit marker writes outside the state directory
`setup_done_path` and friends join a raw game ID, but every shipping caller
validates the ID as a single path component first (the Tauri commands) or takes
it from the catalog. Making the public helpers fallible would change the crate
API for an embedding caller that does not exist.
### [13] Catalog preflight can read outside the package root
Publisher tooling run by the catalog operator over their own package tree; the
@@ -183,8 +164,8 @@ own error message.
## Summary
| Status | Findings |
| --------------- | --------------------------------------------------------------------------------------------------------------------------------- |
| Fixed | NET-02, NET-03, NET-04, EXP2-SEC-03, EXP2-SEC-04, EXP2-SEC-06, SEC-IPC-02, SEC-IPC-03, SEC-DB-01, Codex [2], [6], [9], [14], [15] |
| Partially fixed | NET-01, EXP2-SEC-01, SEC-IPC-01, SEC-IPC-04, Codex [3], [10] |
| Not fixed | NET-05, NET-06, EXP2-SEC-02, EXP2-SEC-05, EXP2-SEC-07, SEC-IPC-05, SEC-FE-01, Codex [1], [4], [5], [7], [8], [11], [12], [13] |
| Status | Findings |
| --------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- |
| Fixed | NET-02, NET-03, NET-04, NET-05, EXP2-SEC-03, EXP2-SEC-04, EXP2-SEC-06, SEC-IPC-02, SEC-IPC-03, SEC-DB-01, Codex [2], [6], [7], [9], [12], [14], [15] |
| Partially fixed | NET-01, EXP2-SEC-01, SEC-IPC-01, SEC-IPC-04, Codex [3], [10] |
| Not fixed | NET-06, EXP2-SEC-02, EXP2-SEC-05, EXP2-SEC-07, SEC-IPC-05, SEC-FE-01, Codex [1], [4], [5], [8], [11], [13] |