umputun / secrets / 33954875533

84%

master: 84%

Pull #134

github

fix: close log, session and rate-limit gaps found in the security review

- mask key and pin in every request log line by path position, not key length;
  12-char keys were logged with the pin in clear
- stop dumping the decoded request body and pin on API JSON decode errors
- bind session signature to uuid.timestamp, reject malformed ids and future
  timestamps, and derive the session secret from SignKey and AuthHash
- trust proxy client-IP headers only behind --proxy-trust-headers; compose
  examples enable it and strip client-supplied headers at the proxy
- keep the decryption key out of the email popup GET, attach it on submit
  only, and document that emailing the link hands the key to the server

29 of 30 new or added lines in 4 files covered. (96.67%)

1735 of 2064 relevant lines covered (84.06%)

80.04 hits per line