mirror of
https://github.com/fusion44/blitz_api.git
synced 2026-08-20 12:57:23 +02:00
97cbd4cb55
password_valid()/name_valid() ended in `return re.match(...)`, which yields a Match object or None. The setup router tests them with `is False`, and `None is False` is False, so the charset check never rejected anything -- only the length and space rules were doing any work. The validators now return real booleans, and use fullmatch: with re.match the trailing `$` also matches just before a final newline. Impact is bounded, and this is a correctness bug rather than a vulnerability. These call sites are reachable only while the node is in `state=waitsetup`, and that same endpoint hands the caller a signed admin JWT by design, on a device where blitzapi has passwordless sudo. A malformed hostname reaching the setup file -- which provisioning sources as bash -- therefore grants nothing the caller does not already have, and in practice the value comes from the operator's own setup form. What it does cost: a hostname containing a quote or `$` corrupts the setup file and breaks provisioning, and the charset gate would not hold as a defence if the setup flow ever gains operator binding. Also in this change: - Gate /setup-start-done and /setup-start-info on setupPhase != "done", as /setup/shutdown already does. `state` lives in the unauthenticated key-value store, so a local process could flip it back to "waitsetup" on a fully provisioned node and be handed an admin JWT. Unlike the above, that is a real escalation, because setup is supposed to be closed at that point. - raise HTTPException instead of returning it (18 sites). FastAPI serialised the returned object as a 200 body, so rejections looked like successes; the WebUI stored that body as its access token. - Fix the status.status.HTTP_405_METHOD_NOT_ALLOWED typo (3 sites) that raised AttributeError and surfaced as an unhandled 500. - Create the setup file 0600. It holds passwords A/B/C in cleartext and provisioning appends the wallet seed words, on a tmpfs mounted mode=0777. Regression tests in tests/test_setup_input_validation.py; all nine fail before this change and pass after. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| models | ||
| routers | ||
| __init__.py | ||
| test_app_manage_lock.py | ||
| test_apps_uninstall_keep_data.py | ||
| test_bitcoin_rpc_success.py | ||
| test_bitcoin_rpc_warmup.py | ||
| test_change_password.py | ||
| test_channel_cleanup.py | ||
| test_cln_list_all_tx.py | ||
| test_cln_shell_safety.py | ||
| test_decode_pay_request_errors.py | ||
| test_electrs_advanced_status.py | ||
| test_error_handlers.py | ||
| test_error_response.py | ||
| test_exec_bash_timeout.py | ||
| test_hardware_info_vm.py | ||
| test_hw_gatherer_resilience.py | ||
| test_jwt.py | ||
| test_lnd_transient_errors.py | ||
| test_native_python_errors.py | ||
| test_send_coins_input.py | ||
| test_setup_input_validation.py | ||
| test_startup_status.py | ||
| test_system_health.py | ||
| test_warmup_events.py | ||
| test_ws_endpoint.py | ||
| test_ws_manager.py | ||
| utils.py | ||