Kyle Isom
ea9375b6ae
CRITICAL: - A-001: SQL injection in snapshot — escape single quotes in backup path - A-002: Timing attack — always verify against dummy hash when user not found, preventing username enumeration - A-003: Notebook ownership — all authenticated endpoints now verify user_id before loading notebook data - A-004: Point data bounds — decodePoints returns error on misaligned data, >4MB payloads, and NaN/Inf values HIGH: - A-005: Error messages — generic errors in HTTP responses, no err.Error() - A-006: Share link authz — RevokeShareLink verifies notebook ownership - A-007: Scan errors — return 500 instead of silently continuing MEDIUM: - A-008: Web server TLS — optional TLS support (HTTPS when configured) - A-009: Input validation — page_size, stroke count, point_data alignment checked in SyncNotebook RPC - A-010: Graceful shutdown — 30s drain on SIGINT/SIGTERM, all servers shut down properly Added AUDIT.md with all 17 findings, status, and rationale for accepted risks. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
97 lines
2.2 KiB
Go
97 lines
2.2 KiB
Go
package webserver
|
|
|
|
import (
|
|
"crypto/tls"
|
|
"database/sql"
|
|
"fmt"
|
|
"html/template"
|
|
"io/fs"
|
|
"net/http"
|
|
"time"
|
|
|
|
"git.wntrmute.dev/kyle/eng-pad-server/web"
|
|
"github.com/go-chi/chi/v5"
|
|
)
|
|
|
|
type Config struct {
|
|
Addr string
|
|
DB *sql.DB
|
|
BaseURL string
|
|
TLSCert string
|
|
TLSKey string
|
|
}
|
|
|
|
type WebServer struct {
|
|
db *sql.DB
|
|
baseURL string
|
|
tmpl *template.Template
|
|
}
|
|
|
|
func Start(cfg Config) (*http.Server, error) {
|
|
templateFS, err := fs.Sub(web.Content, "templates")
|
|
if err != nil {
|
|
return nil, fmt.Errorf("template fs: %w", err)
|
|
}
|
|
|
|
tmpl, err := template.ParseFS(templateFS, "*.html")
|
|
if err != nil {
|
|
return nil, fmt.Errorf("parse templates: %w", err)
|
|
}
|
|
|
|
ws := &WebServer{
|
|
db: cfg.DB,
|
|
baseURL: cfg.BaseURL,
|
|
tmpl: tmpl,
|
|
}
|
|
|
|
r := chi.NewRouter()
|
|
|
|
// Static files
|
|
staticFS, _ := fs.Sub(web.Content, "static")
|
|
r.Handle("/static/*", http.StripPrefix("/static/", http.FileServer(http.FS(staticFS))))
|
|
|
|
// Public routes
|
|
r.Get("/login", ws.handleLoginPage)
|
|
r.Post("/login", ws.handleLoginSubmit)
|
|
|
|
// Share routes (no auth)
|
|
r.Get("/s/{token}", ws.handleShareNotebook)
|
|
r.Get("/s/{token}/pages/{num}", ws.handleSharePage)
|
|
|
|
// Authenticated routes
|
|
r.Group(func(r chi.Router) {
|
|
r.Use(ws.authMiddleware)
|
|
r.Get("/", http.RedirectHandler("/notebooks", http.StatusFound).ServeHTTP)
|
|
r.Get("/notebooks", ws.handleNotebooks)
|
|
r.Get("/notebooks/{id}", ws.handleNotebook)
|
|
r.Get("/notebooks/{id}/pages/{num}", ws.handlePage)
|
|
r.Get("/logout", ws.handleLogout)
|
|
})
|
|
|
|
srv := &http.Server{
|
|
Addr: cfg.Addr,
|
|
Handler: r,
|
|
ReadTimeout: 30 * time.Second,
|
|
WriteTimeout: 30 * time.Second,
|
|
IdleTimeout: 120 * time.Second,
|
|
}
|
|
|
|
if cfg.TLSCert != "" && cfg.TLSKey != "" {
|
|
tlsCert, err := tls.LoadX509KeyPair(cfg.TLSCert, cfg.TLSKey)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("load TLS cert: %w", err)
|
|
}
|
|
srv.TLSConfig = &tls.Config{
|
|
Certificates: []tls.Certificate{tlsCert},
|
|
MinVersion: tls.VersionTLS13,
|
|
}
|
|
fmt.Printf("Web UI listening on %s (TLS)\n", cfg.Addr)
|
|
go func() { _ = srv.ListenAndServeTLS("", "") }()
|
|
} else {
|
|
fmt.Printf("Web UI listening on %s\n", cfg.Addr)
|
|
go func() { _ = srv.ListenAndServe() }()
|
|
}
|
|
|
|
return srv, nil
|
|
}
|