decentraland / comms-gatekeeper / 28616085146

85%

Build Type

push

github

Committed by web-flow

Commit Message

fix: address security audit findings (access control, disclosure, hardening) (#276)

* fix: address security audit findings across access control and hardening

Resolves the findings from a full-codebase security review.

Access control (HIGH):
- Bind LiveKit streaming-key issuance and scene-ban checks to the sceneId that
  forms the room, not a separately-supplied parcel. Previously the admin/ban
  check ran against a place resolved from an unvalidated parcel while the
  room/key was derived from sceneId, allowing cross-scene stream injection and
  a scene-ban bypass via mismatched parcel/sceneId.
- generate-stream-link resolves a world-name-as-sceneId to the real content
  hash so the room and place stay consistent (mirrors comms-scene-handler).
- Require signed-fetch auth on /cast/watcher-token and enforce scene bans on the
  viewer, so a banned user can't rejoin a scene's comms room as a watcher.

Disclosure & secrets (MEDIUM):
- /users/:address/bans (unauthenticated) now returns only user-facing fields
  (isBanned, expiresAt, customMessage), not moderator identity, device id, or
  reason.
- Stop logging the ingress streamKey / ingest URL.
- Remove the committed COMMS_GATEKEEPER_AUTH_TOKEN default from .env.default so
  requireString fails fast; tests get a fixture value via jest setup.
- Add encodeURIComponent to user-influenced URL segments in places/worlds/social.

Robustness & hardening (LOW):
- Close a duplicate-active-ban race with a transaction-scoped advisory lock.
- Add a non-unique partial index on scene_stream_access(ingress_id) (dropped
  with the old unique constraint); guard streaming writes against empty ingress_id.
- Lowercase address in the private voice-chat status lookup.
- Dedup + ON CONFLICT in createVoiceChatRoom; bound bulk community_ids (maxItems).
- Overlap guard on the streaming-key TTL cron; deactivate empty-ingress expired
  rows by place in the streaming TTL cron.
- Protect land-lease holders from scene bans; return 40... (continued)

Coverage Stats

1121 of 1436 branches covered (78.06%)

Branch coverage included in aggregate %.

85 of 94 new or added lines in 21 files covered. (90.43%)

4 existing lines in 1 file now uncovered.

3081 of 3486 relevant lines covered (88.38%)

75.03 hits per line