mirror of
https://github.com/fusion44/blitz_api.git
synced 2026-08-20 12:57:23 +02:00
97cbd4cb55
password_valid()/name_valid() ended in `return re.match(...)`, which yields a Match object or None. The setup router tests them with `is False`, and `None is False` is False, so the charset check never rejected anything -- only the length and space rules were doing any work. The validators now return real booleans, and use fullmatch: with re.match the trailing `$` also matches just before a final newline. Impact is bounded, and this is a correctness bug rather than a vulnerability. These call sites are reachable only while the node is in `state=waitsetup`, and that same endpoint hands the caller a signed admin JWT by design, on a device where blitzapi has passwordless sudo. A malformed hostname reaching the setup file -- which provisioning sources as bash -- therefore grants nothing the caller does not already have, and in practice the value comes from the operator's own setup form. What it does cost: a hostname containing a quote or `$` corrupts the setup file and breaks provisioning, and the charset gate would not hold as a defence if the setup flow ever gains operator binding. Also in this change: - Gate /setup-start-done and /setup-start-info on setupPhase != "done", as /setup/shutdown already does. `state` lives in the unauthenticated key-value store, so a local process could flip it back to "waitsetup" on a fully provisioned node and be handed an admin JWT. Unlike the above, that is a real escalation, because setup is supposed to be closed at that point. - raise HTTPException instead of returning it (18 sites). FastAPI serialised the returned object as a 200 body, so rejections looked like successes; the WebUI stored that body as its access token. - Fix the status.status.HTTP_405_METHOD_NOT_ALLOWED typo (3 sites) that raised AttributeError and surfaced as an unhandled 500. - Create the setup file 0600. It holds passwords A/B/C in cleartext and provisioning appends the wallet seed words, on a tmpfs mounted mode=0777. Regression tests in tests/test_setup_input_validation.py; all nine fail before this change and pass after. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| api | ||
| apps | ||
| auth | ||
| bitcoind | ||
| external | ||
| lightning | ||
| setup | ||
| system | ||
| __init__.py | ||
| celery_app.py | ||
| logging.py | ||
| main.py | ||
| server.py | ||