th/hyprcrd
3
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security: v2.0 — AES-GCM crypto, SSRF guards, rate limits, hardening

Browse Source 
Breaking wire-format change: dual-read (V1+V2) / single-write (V2) so
existing user secrets, stored messages, and inter-tenant key keep
working. Old clients and relays lose cross-version chat until both
sides are upgraded.

Relay
- Switch clientEncrypt/masterEncrypt to AES-256-GCM with HKDF-derived
  per-ciphertext salts; keep CBC-V1 fallback on decrypt only.
- On-bootstrap migration re-envelopes tenant secret_encrypted and the
  inter-tenant key to GCM-V2 (idempotent).
- CORS: stop reflecting arbitrary Origin; allow own origin + optional
  RELAY_CORS_ORIGINS env allowlist; drop Access-Control-Allow-Credentials.
- Generic error messages replace "no such user: <name>" enumeration.
- Exception messages no longer echoed back; logged server-side.
- Collab-lock max hold capped at 10min so a member can't grief-refresh
  forever.
- Attachment filenames validated against hex.<ext> pattern.
- Passwords min length 10; /api/account/password rate-limited.

App / Electron client
- Shared hyprcrdRelayEncrypt/Decrypt helpers (GCM-V2 write, V1 read).
- Chat + collab-buckets plugins delegate to the shared helpers.
- Poll + push + attachments migrated to the dual-format path.
- /api/relay/settings GET returns has_key boolean; secret never echoed.
- Setup endpoint now CSRF-checked.
- SSRF: CURLOPT_PROTOCOLS restricted to HTTP(S) everywhere; bookmarks
  favicon fetch also blocks private/loopback/link-local.
- Login / password-change rate limiter moved to DB-backed IP keying.
- Passwords min length 10 throughout.
- Zip import enforces per-file (25MB) and total (500MB) caps, extension
  allowlist, no-overwrite.
- Verbose relay-push debug gated behind APP_DEBUG env.

Version bumped to 2.0.0 (protocol-breaking).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
thandClaude Opus 4.7 committed 2026-04-17 17:02:04 +02:00
1 parent d50f9fe789
commit d83de30d6d
27 files changed
+473 -168
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

relay/inc/routes/account.php
+4 -1
View File
@@ -52,11 +52,14 @@ if ($route === '/api/account/secret' && $method === 'DELETE') {
if ($route === '/api/account/password' && $method === 'POST') {
if (!$sessionTenant) jsonResponse(['error' => 'not logged in'], 401);
// Rate-limit password changes — a stolen session cookie could otherwise
// brute-force the `current` field server-side with no friction.
if (isRateLimited($db, 'account-password', 10)) jsonResponse(['error' => 'too many attempts'], 429);
$input = json_decode(file_get_contents('php://input'), true) ?: [];
$current = (string)($input['current'] ?? '');
$new = (string)($input['new'] ?? '');
if (strlen($new) < 4) jsonResponse(['error' => 'new password must be at least 4 chars'], 400);
if (strlen($new) < 10) jsonResponse(['error' => 'new password must be at least 10 chars'], 400);
if (!password_verify($current, $sessionTenant['password_hash'])) {
jsonResponse(['error' => 'current password is wrong'], 401);
}
relay/inc/routes/admin.php
+2 -2
View File
@@ -28,7 +28,7 @@ if ($route === '/api/users' && $method === 'POST') {
if (!preg_match('/^[a-zA-Z0-9_-]{2,32}$/', $username)) {
jsonResponse(['error' => 'username must be 2-32 chars: letters, digits, _ or -'], 400);
}
if (strlen($password) < 4) jsonResponse(['error' => 'password must be at least 4 chars'], 400);
if (strlen($password) < 10) jsonResponse(['error' => 'password must be at least 10 chars'], 400);
if (getTenantByUsername($db, $username)) jsonResponse(['error' => 'username already exists'], 409);
// No client secret — the new user sets that themselves after first login
@@ -53,7 +53,7 @@ if (preg_match('#^/api/users/(\d+)$#', $route, $m) && $method === 'PATCH') {
$input = json_decode(file_get_contents('php://input'), true) ?: [];
$fields = []; $params = ['id' => $id];
if (!empty($input['password'])) {
if (strlen($input['password']) < 4) jsonResponse(['error' => 'password too short'], 400);
if (strlen($input['password']) < 10) jsonResponse(['error' => 'password must be at least 10 chars'], 400);
$fields[] = 'password_hash = :pw';
$params['pw'] = password_hash($input['password'], PASSWORD_BCRYPT);
}
relay/inc/routes/chat.php
+6 -5
View File
@@ -93,7 +93,7 @@ if ($route === '/api/chat/send' && $method === 'POST' && $sessionTenant) {
if ($body === '') jsonResponse(['error' => 'body required'], 400);
if ($recipientName === '') jsonResponse(['error' => 'recipient required'], 400);
$recipient = getTenantByUsername($db, $recipientName);
if (!$recipient) jsonResponse(['error' => "no such user: $recipientName"], 404);
if (!$recipient) jsonResponse(['error' => 'recipient not found'], 404);
$interKey = getInterTenantKey($db, $MASTER_KEY);
if (!$interKey) jsonResponse(['error' => 'relay super-shared key not set'], 500);
$stored = clientEncrypt($body, $interKey);
@@ -122,7 +122,7 @@ if ($route === '/api/sync-events' && $method === 'POST') {
if ($recipientName === '') jsonResponse(['error' => 'recipient required'], 400);
if ($recipientName === $clientTenant['username']) jsonResponse(['ok' => true, 'id' => 0]); // suppress self-notifications
$recipient = getTenantByUsername($db, $recipientName);
if (!$recipient) jsonResponse(['error' => "no such user: $recipientName"], 404);
if (!$recipient) jsonResponse(['error' => 'recipient not found'], 404);
$db->prepare('INSERT INTO relay_sync_events (recipient_id, sender_username, body) VALUES (:r, :sn, :b)')
->execute(['r' => $recipient['id'], 'sn' => $clientTenant['username'], 'b' => $body]);
jsonResponse(['ok' => true, 'id' => (int)$db->lastInsertId()]);
@@ -193,7 +193,8 @@ if ($route === '/api/chat/rooms' && $method === 'POST') {
$db->commit();
} catch (Throwable $e) {
if ($db->inTransaction()) $db->rollBack();
jsonResponse(['error' => 'create failed: ' . $e->getMessage()], 500);
@error_log('[hyprcrd-relay] chat room create failed: ' . $e->getMessage());
jsonResponse(['error' => 'create failed'], 500);
}
jsonResponse(['ok' => true, 'uid' => $uid, 'members' => array_values($resolved)]);
}
@@ -306,7 +307,7 @@ if ($route === '/api/chat' && $method === 'POST') {
->execute(['me' => $clientTenant['id'], 's' => $clientTenant['id'], 'sn' => $clientTenant['username'], 'ru' => $roomUid, 'b' => $stored]);
} else {
$recipient = getTenantByUsername($db, $recipientName);
if (!$recipient) jsonResponse(['error' => "no such user: $recipientName"], 404);
if (!$recipient) jsonResponse(['error' => 'recipient not found'], 404);
$db->prepare('INSERT INTO chat_messages (recipient_id, sender_id, sender_username, body, persistent) VALUES (:r, :s, :sn, :b, :p)')
->execute([
'r' => $recipient['id'],
@@ -417,7 +418,7 @@ if ($route === '/api/chat/backfill' && $method === 'GET') {
$stmt->execute();
} else {
$peerTenant = getTenantByUsername($db, $peer);
if (!$peerTenant) jsonResponse(['error' => "no such user: $peer"], 404);
if (!$peerTenant) jsonResponse(['error' => 'peer not found'], 404);
$sql = "SELECT id, sender_id, sender_username, room_uid, body, created_at
FROM chat_messages
WHERE room_uid IS NULL
relay/inc/routes/collab-buckets.php
+3 -2
View File
@@ -50,7 +50,8 @@ if ($route === '/api/collab-buckets' && $method === 'POST') {
$db->commit();
} catch (Throwable $e) {
if ($db->inTransaction()) $db->rollBack();
jsonResponse(['error' => 'create failed: ' . $e->getMessage()], 500);
@error_log('[hyprcrd-relay] collab bucket create failed: ' . $e->getMessage());
jsonResponse(['error' => 'create failed'], 500);
}
jsonResponse(['ok' => true, 'uid' => $uid, 'members' => array_values($resolved)]);
}
@@ -102,7 +103,7 @@ if (preg_match('#^/api/collab-buckets/([a-zA-Z0-9_-]+)$#', $route, $m) && $metho
$newOwnerName = trim((string)$input['owner']);
if ($newOwnerName === '') jsonResponse(['error' => 'owner cannot be empty'], 400);
$newOwner = getTenantByUsername($db, $newOwnerName);
if (!$newOwner) jsonResponse(['error' => "no such user: $newOwnerName"], 404);
if (!$newOwner) jsonResponse(['error' => 'user not found'], 404);
$memCheck = $db->prepare('SELECT 1 FROM collab_bucket_members WHERE bucket_uid = :b AND tenant_id = :t');
$memCheck->execute(['b' => $uid, 't' => $newOwner['id']]);
if (!$memCheck->fetchColumn()) {
relay/inc/routes/collab-cards.php
+10
View File
@@ -243,6 +243,14 @@ if (preg_match('#^/api/collab-cards/([a-zA-Z0-9_-]+)/([a-zA-Z0-9_-]+)$#', $route
// ── Collab attachments (images/PDFs/audio referenced by collab cards) ─
// Attachment filenames always follow the hyprcrd upload pattern
// (bin2hex(random_bytes(16)).<ext>). Enforce server-side so malicious
// clients can't poison the DB with traversal-shaped names that later
// surface in UIs or get forwarded to filesystem APIs.
function collabAttachmentFilenameValid(string $fn): bool {
return (bool)preg_match('/^[a-f0-9]{8,64}\.[a-z0-9]{1,8}$/', $fn);
}
if ($route === '/api/collab-attachments' && $method === 'POST') {
if (!$clientTenant) jsonResponse(['error' => 'unauthorized'], 401);
$input = json_decode(file_get_contents('php://input'), true) ?: [];
@@ -250,6 +258,7 @@ if ($route === '/api/collab-attachments' && $method === 'POST') {
$filename = (string)($input['filename'] ?? '');
$data = (string)($input['data'] ?? '');
if (!$bucketUid || !$filename || !$data) jsonResponse(['error' => 'bucket_uid, filename, and data required'], 400);
if (!collabAttachmentFilenameValid($filename)) jsonResponse(['error' => 'invalid filename'], 400);
if (!collabCardsIsMember($db, $bucketUid, (int)$clientTenant['id'])) {
jsonResponse(['error' => 'not a member of this bucket'], 403);
}
@@ -277,6 +286,7 @@ if ($route === '/api/collab-attachments' && $method === 'GET') {
$bucketUid = trim($_GET['bucket_uid'] ?? '');
$filename = trim($_GET['filename'] ?? '');
if (!$bucketUid) jsonResponse(['error' => 'bucket_uid required'], 400);
if ($filename !== '' && !collabAttachmentFilenameValid($filename)) jsonResponse(['error' => 'invalid filename'], 400);
if (!collabCardsIsMember($db, $bucketUid, (int)$clientTenant['id'])) {
jsonResponse(['error' => 'not a member of this bucket'], 403);
}
relay/inc/routes/collab-locks.php
+12 -1
View File
@@ -20,6 +20,13 @@ function collabLocksIsMember(PDO $db, string $bucketUid, int $tenantId): bool {
// ── POST: acquire/refresh ────────────────────────────────────────
// Maximum time a single holder can keep refreshing the same lock. Without a
// cap a malicious member could heartbeat forever, blocking every other
// member's writes. 10 minutes is long enough for any real edit session and
// short enough to time-box grief. When the cap is hit the lock is force-
// released and the client must re-acquire — giving everyone else a window.
const COLLAB_LOCK_MAX_HOLD_SECONDS = 600;
if ($route === '/api/collab-locks' && $method === 'POST') {
if (!$clientTenant) jsonResponse(['error' => 'unauthorized'], 401);
if (isRateLimited($db, 'collab-locks-post', 240)) jsonResponse(['error' => 'rate limited'], 429);
@@ -35,8 +42,12 @@ if ($route === '/api/collab-locks' && $method === 'POST') {
// narrow window between cleanup and this query.
$db->prepare("DELETE FROM collab_card_locks WHERE bucket_uid = :b AND card_uid = :c AND expires_at <= datetime('now')")
->execute(['b' => $bucketUid, 'c' => $cardUid]);
// Also drop locks that have been refreshed past the max hold window —
// cap enforcement for grief prevention.
$db->prepare("DELETE FROM collab_card_locks WHERE bucket_uid = :b AND card_uid = :c AND acquired_at <= datetime('now', '-" . COLLAB_LOCK_MAX_HOLD_SECONDS . " seconds')")
->execute(['b' => $bucketUid, 'c' => $cardUid]);
// Existing live lock? If a different tenant holds it, refuse.
$cur = $db->prepare('SELECT holder_id, holder_username, expires_at FROM collab_card_locks WHERE bucket_uid = :b AND card_uid = :c');
$cur = $db->prepare('SELECT holder_id, holder_username, expires_at, acquired_at FROM collab_card_locks WHERE bucket_uid = :b AND card_uid = :c');
$cur->execute(['b' => $bucketUid, 'c' => $cardUid]);
$existing = $cur->fetch();
if ($existing && (int)$existing['holder_id'] !== (int)$clientTenant['id']) {
relay/inc/routes/messages.php
+7 -4
View File
@@ -21,7 +21,7 @@ if ($route === '/api/messages' && $method === 'POST' && $sessionTenant && empty(
if ($body === '') jsonResponse(['error' => 'body required'], 400);
$recipient = getTenantByUsername($db, $recipientName);
if (!$recipient) jsonResponse(['error' => "no such user: $recipientName"], 404);
if (!$recipient) jsonResponse(['error' => 'recipient not found'], 404);
$interKey = getInterTenantKey($db, $MASTER_KEY);
if (!$interKey) jsonResponse(['error' => 'relay super-shared key not set'], 500);
@@ -54,7 +54,7 @@ if ($route === '/api/attachments/upload' && $method === 'POST' && $sessionTenant
if (!$relayUid) jsonResponse(['error' => 'relay_uid required'], 400);
$recipient = getTenantByUsername($db, $recipientName);
if (!$recipient) jsonResponse(['error' => "no such user: $recipientName"], 404);
if (!$recipient) jsonResponse(['error' => 'recipient not found'], 404);
$interKey = getInterTenantKey($db, $MASTER_KEY);
if (!$interKey) jsonResponse(['error' => 'relay super-shared key not set'], 500);
@@ -142,7 +142,7 @@ if ($route === '/api/messages' && $method === 'POST') {
if ($encryptedBody === '') jsonResponse(['error' => 'body required'], 400);
$recipient = getTenantByUsername($db, $recipientName);
if (!$recipient) jsonResponse(['error' => "no such user: $recipientName"], 404);
if (!$recipient) jsonResponse(['error' => 'recipient not found'], 404);
// Decrypt with sender's secret
if (empty($clientTenant['secret_encrypted'])) {
@@ -225,9 +225,12 @@ if ($route === '/api/attachments' && $method === 'POST') {
$data = (string)($input['data'] ?? '');
$recipientName = trim((string)($input['recipient'] ?? $clientTenant['username']));
if (!$relayUid || !$filename || !$data) jsonResponse(['error' => 'relay_uid, filename, and data required'], 400);
// Enforce the hyprcrd upload naming scheme server-side so traversal-shaped
// names never enter storage or get forwarded back to other clients.
if (!preg_match('/^[a-f0-9]{8,64}\.[a-z0-9]{1,8}$/', $filename)) jsonResponse(['error' => 'invalid filename'], 400);
$recipient = getTenantByUsername($db, $recipientName);
if (!$recipient) jsonResponse(['error' => "no such user: $recipientName"], 404);
if (!$recipient) jsonResponse(['error' => 'recipient not found'], 404);
// Decrypt-reencrypt hop, same shape as messages: arrives encrypted with
// sender's secret, gets stored at-rest under the inter-tenant key.
relay/inc/routes/public.php
+1 -1
View File
@@ -49,7 +49,7 @@ if ($route === '/api/setup' && $method === 'POST') {
if (!preg_match('/^[a-zA-Z0-9_-]{2,32}$/', $username)) {
jsonResponse(['error' => 'username must be 2-32 chars: letters, digits, _ or -'], 400);
}
if (strlen($password) < 4) jsonResponse(['error' => 'password must be at least 4 chars'], 400);
if (strlen($password) < 10) jsonResponse(['error' => 'password must be at least 10 chars'], 400);
if (strlen($superSecret) < 12) jsonResponse(['error' => 'super-shared secret must be at least 12 chars'], 400);
// Create the admin tenant. NO client secret yet — the admin (and every