decentraland / comms-gatekeeper / 28594276409

85%

main: 85%

Build Type

Pull #276

github

Committed by LautaroPetaccio

Commit Message

fix: address security audit findings across access control and hardening

Resolves the findings from a full-codebase security review.

Access control (HIGH):
- Bind LiveKit streaming-key issuance and scene-ban checks to the sceneId that
  forms the room, not a separately-supplied parcel. Previously the admin/ban
  check ran against a place resolved from an unvalidated parcel while the
  room/key was derived from sceneId, allowing cross-scene stream injection and
  a scene-ban bypass via mismatched parcel/sceneId.
- generate-stream-link resolves a world-name-as-sceneId to the real content
  hash so the room and place stay consistent (mirrors comms-scene-handler).
- Require signed-fetch auth on /cast/watcher-token and enforce scene bans on the
  viewer, so a banned user can't rejoin a scene's comms room as a watcher.

Disclosure & secrets (MEDIUM):
- /users/:address/bans (unauthenticated) now returns only user-facing fields
  (isBanned, expiresAt, customMessage), not moderator identity, device id, or
  reason.
- Stop logging the ingress streamKey / ingest URL.
- Remove the committed COMMS_GATEKEEPER_AUTH_TOKEN default from .env.default so
  requireString fails fast; tests get a fixture value via jest setup.
- Add encodeURIComponent to user-influenced URL segments in places/worlds/social.

Robustness & hardening (LOW):
- Close a duplicate-active-ban race with a transaction-scoped advisory lock.
- Add a non-unique partial index on scene_stream_access(ingress_id) (dropped
  with the old unique constraint); guard streaming writes against empty ingress_id.
- Lowercase address in the private voice-chat status lookup.
- Dedup + ON CONFLICT in createVoiceChatRoom; bound bulk community_ids (maxItems).
- Overlap guard on the streaming-key TTL cron; deactivate empty-ingress expired
  rows by place in the streaming TTL cron.
- Protect land-lease holders from scene bans; return 400 (not 500) on a malformed
  remove-scene-admin body; run the container as the non-root node user.

Pull Request Pull Request #276: fix: address security audit findings (access control, disclosure, hardening)

Coverage Stats

1128 of 1450 branches covered (77.79%)

Branch coverage included in aggregate %.

79 of 95 new or added lines in 18 files covered. (83.16%)

1 existing line in 1 file now uncovered.

3098 of 3503 relevant lines covered (88.44%)

74.7 hits per line