39c7ac1924
Rootless podman migration (TASK-11): - Remove sudo from all podman calls in PodmanClient + 8 backend files - Remove sudo from all podman/docker calls in deploy script - Restore full systemd security hardening: NoNewPrivileges, RestrictAddressFamilies, MemoryDenyWriteExecute, RestrictRealtime, RestrictNamespaces, RestrictSUIDSGID, SystemCallFilter, ProtectSystem=strict - Enable loginctl linger for rootless container persistence - Remove Ollama from auto-deploy (marketplace-only) Session & auth hardening: - Increase MAX_CONCURRENT_SESSIONS 20→50 (prevents eviction storms) - Debounced 401 redirect in rpc-client.ts (prevents redirect storms) Boot stability: - optimize-debian.sh: adds chrony, swap, removes policy-rc.d - deploy script: pre-restart chrony + swap setup - ISO build: chrony package, swap file creation - BootScreen: no longer clears localStorage (prevents splash replay) - RootRedirect: sole owner of localStorage clearing on server ready UI fixes: - Sidebar opacity default changed from 0→visible (fixes missing sidebar after page-persistence login without entrance animation) - Console.log/error wrapped in import.meta.env.DEV guards - Remove unused route import from RootRedirect Beta tracking: - CLAUDE.md: beta freeze protocol added - MASTER_PLAN.md: TASK-11, TASK-17, phase structure - BETA-PROGRESS.md: initial tracking doc - Tagged v1.2.0-alpha.1 as pre-rootless baseline Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
36 lines
1.1 KiB
JSON
36 lines
1.1 KiB
JSON
{
|
|
"findings": [
|
|
{
|
|
"id": "XSS-001",
|
|
"type": "dom_based_xss_iframe_src_injection",
|
|
"endpoint": "/app/:appId",
|
|
"parameter": "path (query)",
|
|
"confidence": "medium",
|
|
"payload_suggestion": "/app/indeedhub?path=%23<img+onerror=alert(1)+src=x>"
|
|
},
|
|
{
|
|
"id": "XSS-002",
|
|
"type": "dom_based_xss_javascript_uri_redirect",
|
|
"endpoint": "/login",
|
|
"parameter": "redirect (query)",
|
|
"confidence": "medium",
|
|
"payload_suggestion": "/login?redirect=javascript:alert(document.cookie)"
|
|
},
|
|
{
|
|
"id": "XSS-003",
|
|
"type": "dom_based_cross_origin_message_injection",
|
|
"endpoint": "postMessage handler (NIP-07)",
|
|
"parameter": "event.data (nostr-request)",
|
|
"confidence": "high",
|
|
"payload_suggestion": "window.parent.postMessage({type:'nostr-request',id:'1',method:'getPublicKey'},'*')"
|
|
},
|
|
{
|
|
"id": "XSS-004",
|
|
"type": "weak_csp_unsafe_inline",
|
|
"endpoint": "all pages (nginx)",
|
|
"parameter": "n/a",
|
|
"confidence": "high",
|
|
"payload_suggestion": "n/a - amplification factor, not direct XSS"
|
|
}
|
|
]
|
|
} |