mirror of
https://github.com/barkeser2002/offline-db.git
synced 2026-09-25 01:40:07 +03:00
1679d766c9
Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com> Co-authored-by: Senpai-YoloBot <41898282+github-actions[bot]@users.noreply.github.com>
66 lines
8.6 KiB
Markdown
66 lines
8.6 KiB
Markdown
## 2026-03-13 - [RoomViewSet IDOR vulnerability]
|
|
**Vulnerability:** RoomViewSet lacked authorization checks for update/delete. Any authenticated user could modify or delete ANY room by sending PUT/DELETE requests to `/api/watch-parties/{uuid}/`.
|
|
**Learning:** ModelViewSet provides `update` and `destroy` actions by default. Without custom permissions (like `IsHostOrReadOnly`) or overriding `get_queryset()` to filter by user for unsafe methods, IDOR vulnerabilities are introduced.
|
|
**Prevention:** Override `perform_update` and `perform_destroy` to check `instance.host == self.request.user`, or use a custom permission class, or filter `get_queryset()`.
|
|
|
|
## 2026-03-08 - [Clickjacking via X-Frame-Options]
|
|
**Vulnerability:** `X_FRAME_OPTIONS` was set to `'SAMEORIGIN'` allowing the site to be framed by pages on the same origin. While safer than no restriction, it still leaves a minor clickjacking risk if an attacker can host malicious content on the same origin (e.g., via file upload vulnerabilities).
|
|
**Learning:** Explicitly denying all framing offers the highest level of protection against clickjacking.
|
|
**Prevention:** Set `X_FRAME_OPTIONS = 'DENY'` in Django settings to completely block the site from being rendered within a `<frame>`, `<iframe>`, `<embed>`, or `<object>`.
|
|
|
|
## 2026-03-08 - [Insecure Session Cookies]
|
|
**Vulnerability:** `SESSION_COOKIE_SECURE`, `SESSION_COOKIE_HTTPONLY`, and `SESSION_COOKIE_SAMESITE` were either missing or conditionally enabled only in production.
|
|
**Learning:** Session cookies must always be transmitted securely and protected from client-side scripts to prevent session hijacking via XSS or network interception.
|
|
**Prevention:** Explicitly define `SESSION_COOKIE_SECURE = True`, `SESSION_COOKIE_HTTPONLY = True`, and `SESSION_COOKIE_SAMESITE = 'Lax'` in settings to enforce secure cookie handling.
|
|
|
|
## 2026-03-08 - [Missing CSRF Trusted Origins]
|
|
**Vulnerability:** The `CSRF_TRUSTED_ORIGINS` setting was missing, preventing secure cross-origin requests from functioning correctly when Django is deployed behind certain proxies or specific domain structures.
|
|
**Learning:** When deploying Django to modern environments, explicitly defining trusted origins for CSRF is necessary, especially if the site relies on specific HTTPS domains or handles cross-site POST requests.
|
|
**Prevention:** Read `CSRF_TRUSTED_ORIGINS` from environment variables, allowing dynamic configuration of trusted domains in production environments (e.g., `os.getenv('CSRF_TRUSTED_ORIGINS', '...').split(',')`).
|
|
|
|
## 2024-05-24 - [Exposed Video Encryption Key]
|
|
**Vulnerability:** The `encryption_key` field was included in the `VideoFileSerializer`, exposing the HLS video encryption key in plain text via the API.
|
|
**Learning:** Django Rest Framework's `ModelSerializer` will expose sensitive fields if they are explicitly listed in the `fields` array of the `Meta` class, bypassing the intended secure serving mechanisms (like `KeyServeView`).
|
|
**Prevention:** Never include sensitive fields (passwords, encryption keys, tokens) in standard API serializers unless explicitly required and protected. Serve them securely via dedicated endpoints with appropriate authentication and authorization checks.
|
|
|
|
## 2026-03-07 - [Path Traversal in StorageManager]
|
|
**Vulnerability:** Path traversal vulnerability in `LocalStorage` where `remote_path` is directly joined with `base_path` using `os.path.join(self.base_path, remote_path)` without verifying that the resulting path is strictly contained within the base directory. A malicious user could potentially exploit this to delete arbitrary files, upload files to arbitrary locations, or check for existence of arbitrary files on the filesystem.
|
|
**Learning:** `os.path.join` does not protect against path traversal attacks if the right-hand path is an absolute path or contains `..` components. Furthermore, checking if a path starts with another using `.startswith` is vulnerable to sibling directory attacks.
|
|
**Prevention:** Always use `os.path.abspath(os.path.join(base, path))` and ensure the resulting string is strictly a sub-path using `os.path.commonpath([base, resulting_path]) == base` before proceeding with file operations.
|
|
|
|
## 2026-03-10 - [API Rate Limiting for Creation Endpoints]
|
|
**Vulnerability:** Core API endpoints for user creation actions (`login`, `watchlog`, `review`) lacked specific rate limiting, making them susceptible to brute-force attacks and spamming (e.g., creating hundreds of watch logs or reviews to abuse the badge system).
|
|
**Learning:** Applying rate limits globally or generically can negatively impact read operations (`GET`). To protect mutation endpoints (`POST`) without degrading read performance or user experience, custom `UserRateThrottle` subclasses should override `allow_request` to selectively throttle specific HTTP methods.
|
|
**Prevention:** Implement endpoint-specific throttling using DRF's `DEFAULT_THROTTLE_RATES` and custom throttle classes (like `WatchLogCreateThrottle` and `ReviewCreateThrottle`) that check `if request.method != 'POST': return True` to restrict only unsafe or creation operations.
|
|
|
|
## YYYY-MM-DD - [XSS in Review Descriptions]
|
|
**Vulnerability:** The `Review` model allowed raw HTML and JavaScript to be injected in the `text` field, posing an XSS risk.
|
|
**Learning:** All user-submitted text fields should be stripped of potential HTML and JS code.
|
|
**Prevention:** Utilizing `bleach` in DRF serializers (`bleach.clean(value, tags=[], strip=True)`) prevents the storage of malicious strings.
|
|
|
|
## 2026-03-19 - Username XSS/Injection validation
|
|
**Vulnerability:** Usernames were not validated upon profile update, making the system vulnerable to XSS attacks, injection attacks, or malformed data issues if users set their usernames to strings containing special characters or HTML tags.
|
|
**Prevention:** Added a `validate_username` method to `UserProfileUpdateSerializer` to ensure the username matches the `^[\w-]+$` regex (only letters, numbers, hyphens, and underscores).
|
|
|
|
## 2026-03-XX - Missing MIME Type Validation for Image Uploads
|
|
**Vulnerability:** URLFields and FileFields configured to accept images lacked strict MIME type and extension validation. This allowed potential malicious file uploads (e.g., polyglot files disguised as images) or fetching of unsafe files via URLs.
|
|
**Prevention:** Created `validate_image_mimetype` in `core/validators.py` and strictly enforced it across all Image URL fields across models in `content/models.py` and `users/models.py` (e.g. `cover_image`, `banner_image`, `icon_url`). Validates both by URL path extension and `mimetypes.guess_type`.
|
|
|
|
## 2026-03-20 - Dependency Vulnerabilities Fix
|
|
**Vulnerability:** The project had several dependency vulnerabilities in `requirements.txt` and `frontend/package.json` that could lead to DoS, ReDoS, XSS, and Prototype Pollution attacks.
|
|
**Learning:** `pip-audit` and `npm audit` should be run regularly to ensure all dependencies are up to date and secure.
|
|
**Prevention:** Updated `django<5`, `djangorestframework-simplejwt==5.5.1` and ran `npm audit fix --force` and `pnpm install next@latest` to resolve vulnerabilities.
|
|
|
|
## 2026-03-20 - Missing Security Headers
|
|
**Vulnerability:** The application was missing several crucial HTTP security headers, including `Referrer-Policy`, `Permissions-Policy`, and a nonce-based `Content-Security-Policy`. This left the application vulnerable to cross-site scripting (XSS) via inline scripts, unintended referrer information leakage, and unauthorized access to device features like cameras and microphones.
|
|
**Learning:** Adding robust security headers provides defense-in-depth against various client-side attacks.
|
|
**Prevention:** Implemented a custom `SecurityHeadersMiddleware` to enforce `Referrer-Policy: strict-origin-when-cross-origin` and `Permissions-Policy: camera=(), microphone=()`. Updated `CSP_SCRIPT_SRC` and `CSP_INCLUDE_NONCE_IN` to require a nonce for inline scripts, mitigating XSS risks. Verified `SECURE_HSTS_SECONDS` is enabled in production.
|
|
|
|
## 2026-03-24 - Profile Bio XSS & Validation
|
|
**Vulnerability:** User-provided bio field in `User` model could contain unescaped HTML, leading to Stored XSS when rendered in profile view or other places.
|
|
**Prevention:** Added explicit `bleach.clean(value, tags=[], strip=True)` logic in `UserProfileUpdateSerializer` to actively strip all HTML tags from the input on PATCH, preserving just the plain text.
|
|
|
|
## 2026-03-24 - Model Validator Migrations
|
|
**Vulnerability:** Missing validator functions (`validate_image_mimetype` and `UsernameValidator`) breaking database migrations.
|
|
**Prevention:** Ensured the exact functions referenced in migration states are implemented. Also consolidated all migrations that declare `bio` on `User` into a single, clean migration to resolve `NodeNotFoundError`s.
|