hobokenchicken
215f931311
- Add CheckChannelPermission to permissions.Checker (layers channel overrides on top of role permissions) - Refactor requireChannelAccess to accept required permission bitmap - Message Create checks SEND_MESSAGES; List/Search check VIEW_CHANNEL - BulkDelete uses Checker.CheckPermission for MANAGE_MESSAGES - Channel handler List filters out channels user cannot view - Remove dead checkPermission method from message handler - Fix frontend avatar upload: parse response URL, call updateProfile
64 lines
3.9 KiB
Markdown
64 lines
3.9 KiB
Markdown
# dumpsterChat Codebase Audit Report
|
|
|
|
This document contains a comprehensive audit of the dumpsterChat repository, highlighting security vulnerabilities, functional bugs, dead code, and maintenance issues.
|
|
|
|
---
|
|
|
|
## 1. Security Vulnerabilities & Bypasses
|
|
|
|
### 🚨 Plaintext Webhook Tokens Stored in Database ✅ RESOLVED
|
|
* **Location:** [internal/db/db.go](file:///opt/dumpsterChat/internal/db/db.go#L189), [internal/webhook/handlers.go](file:///opt/dumpsterChat/internal/webhook/handlers.go#L143-L151)
|
|
* **Fix:** Plaintext token column has been dropped via DDL migration (`ALTER TABLE webhooks DROP COLUMN IF EXISTS token;`), and webhook creation no longer stores plaintext tokens in the database.
|
|
|
|
### 🚨 Message and Channel Access Bypasses Role Permissions & Overrides ✅ RESOLVED
|
|
* **Location:** [internal/message/handlers.go](file:///opt/dumpsterChat/internal/message/handlers.go), [internal/channel/handlers.go](file:///opt/dumpsterChat/internal/channel/handlers.go)
|
|
* **Fix:** Added `CheckChannelPermission` method to `permissions.Checker` that layers channel overrides on top of role permissions. Updated `requireChannelAccess` to accept a required permission bitmap — message Create checks `SEND_MESSAGES`, List/Search check `VIEW_CHANNEL`, BulkDelete uses `CheckPermission` for `MANAGE_MESSAGES`. Channel handler List now filters out channels the user cannot view.
|
|
|
|
### ⚠️ WebAuthn Session Cookie SameSite Laxity ✅ RESOLVED
|
|
* **Location:** [internal/auth/cookie.go](file:///opt/dumpsterChat/internal/auth/cookie.go#L17)
|
|
* **Fix:** Changed SameSite configuration to `http.SameSiteStrictMode`.
|
|
|
|
### ⚠️ WebAuthn Session Cookie Secure Flag Relies on Env Var ✅ RESOLVED
|
|
* **Location:** [internal/auth/cookie.go](file:///opt/dumpsterChat/internal/auth/cookie.go#L12)
|
|
* **Fix:** Default `secure` is now set to `true` unless `COOKIE_SECURE=false` is explicitly set in environment variables.
|
|
|
|
---
|
|
|
|
## 2. Functional Bugs & Defects
|
|
|
|
### 🐛 User Avatar Cannot Be Changed ✅ RESOLVED
|
|
* **Location:** [internal/auth/handlers.go](file:///opt/dumpsterChat/internal/auth/handlers.go#L210-L220), [web/src/components/UserSettings.tsx](file:///opt/dumpsterChat/web/src/components/UserSettings.tsx)
|
|
* **Fix:** Backend accepts `avatar_url` in PATCH profile. Frontend upload now parses the returned URL and calls `updateProfile` to save it. `UpdateProfilePayload` type also gained the `avatar_url` field.
|
|
|
|
### 🐛 TUI Client Auth Failure Fallback Bug ✅ RESOLVED
|
|
* **Location:** [cmd/tui/auth.go](file:///opt/dumpsterChat/cmd/tui/auth.go#L21-L36)
|
|
* **Fix:** Correctly handles password input via fallback `pwLine` scanner without overwriting the user's email address.
|
|
|
|
---
|
|
|
|
## 3. Dead Code
|
|
|
|
### 🗑️ Unused `ComputeChannelPermissions` ✅ RESOLVED
|
|
* **Location:** [internal/permissions/overrides.go](file:///opt/dumpsterChat/internal/permissions/overrides.go)
|
|
* **Fix:** Unused function removed from the package.
|
|
|
|
### 🗑️ Duplicated Permission Verification ✅ RESOLVED
|
|
* **Location:** [internal/message/handlers.go](file:///opt/dumpsterChat/internal/message/handlers.go)
|
|
* **Fix:** Removed the dead `checkPermission` method. Callers now use the `Checker` from the `permissions` package and its new `CheckChannelPermission` method.
|
|
|
|
### 🗑️ Obsolete Handler Type ✅ RESOLVED
|
|
* **Location:** [internal/message/handlers.go](file:///opt/dumpsterChat/internal/message/handlers.go)
|
|
* **Fix:** Removed obsolete `Handler_old` struct definition.
|
|
|
|
---
|
|
|
|
## 4. Maintenance & Infrastructure
|
|
|
|
### 🧪 No Tests
|
|
* **Description:** There are zero unit or integration tests in the Go backend or React frontend (`go test ./...` runs but finds no test files).
|
|
* **Remediation:** Introduce tests for critical components such as permissions checking, message parsing, and session stores.
|
|
|
|
### 🔑 Hardcoded Valkey Password Placeholder ✅ RESOLVED
|
|
* **Location:** [internal/config/config.go](file:///opt/dumpsterChat/internal/config/config.go#L111)
|
|
* **Fix:** Default fallback URL set to `redis://localhost:6379`.
|