git.iko.soy/skrepka
on a263102 help sign in
a263102Fix four security and correctness bugs in server.knot: safeCompareLoop constant-time comparison for strings >256 chars, server name normalization before length validation DoS, backgroundPrune recursion stack growth, and cloud metadata/mDNS hostname SSRFiko 013d6d4Fix five security and correctness bugs in server.knot: AckMessages eviction gated on auth, safeCompareLoop constant-time for secrets >256 chars, broadcastOfflineGossip TTL floor for short-lived entries, verifyFederationAuth constant-time when disabled, evictOldestAckedIds/pollOnce union dedup handlingiko 918fbd2Fix four bugs: AckMessages federation ack deduplication, VerifyAuth challenge clearing, session cap global eviction, and offline timestamp clampingiko 05d753cFix six bugs: sendBatchedGossip per-server batching, broadcastOfflineGossip timestamps, ReqChallenge global eviction, LookupPresence scan efficiency, ForwardMessage auth checks, AckMessages reinsertioniko e8a6a25Fix five bugs: evictOldestAckedIds heap dedup tracking, sendBatchedGossip batch/rest split, AckMessages cascade eviction, ReqChallenge expired challenge counting, LookupPresence presence entry fallthroughiko be521ddFix three bugs: safeCompare constant-time comparison, forward entry cleanup on success, and acked ID eviction with reinsertioniko e01d161Fix five security and correctness bugs: safeCompare timing leak for secrets >256 chars, retryPendingForwards success cleanup, AckMessages eviction deduplication and capacity capping, and RecvGossip offline timestamp tie-breakingiko fa38fa7Fix four bugs: SendMessage mailbox full, evicted acks retry, RecvGossip trust check expiryiko adeccc3Fix four correctness and security bugs: lost federation acks on eviction, safeCompare for strings >256 chars, ForwardMessage duplicate check during pruning rate-limiting, and verifyMaintenanceAuth timing side-channeliko e59b702Fix five security and correctness bugs: poll cursor re-delivery, ackedIds eviction duplicate delivery, backgroundPrune missing federation retry, safeCompare timing leak, and verifyMaintenanceAuth timing side-channeliko 5a23463Fix three bugs: duplicate delivery on failed acks, long-poll deadline hang, and thundering herdiko 8815b21Fix SSRF via port-only hostnames, ackedIds batch eviction, and remove dead codeiko 9a8af83Fix pruning timer, stale gossip timestamp in long poll, and federation ack retryiko d7f8914Fix 5 security and correctness bugs: gossip re-propagation, long polling, offline event filtering, challenge replay, and silent ID dropsiko af04984Fix messageMaxAge, messageIds DoS, maintenance auth timing leak, hexDigit overflow, and per-request prune overheadiko e987c00Fix ackedIds unbounded growth, premature forward cleanup, and CGNAT hostname false positivesiko b157c1cFix serverHost normalization mismatch, forward retry data loss, safeCompare timing leak, and SSRF gapsiko 574bd2fFix leading-dot SSRF bypass, duplicate delivery after ack, and unclamped gossip TTLiko 3b2ae7bStop deleting messages on FederationAck to prevent message lossiko af34851Fix orphaned forward records for locally-delivered messages and remove dead codeiko ea729eaFix multicast SSRF gap, global session cap, gossip hex normalization, and octal false positivesiko 0079aa1Fix SSRF case/dot bypass, safeCompare timing leak, missing reserved ranges, federation ack loss, and timestamp clampingiko a1766bfFix SSRF bypass, safeCompare timing, challenge cap, retry backoff, and empty server nameiko 3d65e98Fix LookupPresence normalizeHex crash, safeCompare length handling, and genToken entropyiko 7c133a3Fix gossip batching overflow, multi-hop trust propagation, normalizeHex crash, forwards cap, IPv6 SSRF, federation retry, and gossip capacity reclaimiko d670413Fix safeCompare length leak, offline gossip trust bypass, hop-0 injection, federation retry, and per-recipient message capiko 5b68b19Fix safeCompare timing leak, federation ack message loss, gossip hop-0 rejection, federation retry, and gossip source spoofingiko 07b1accFix URL backslash injection, safeCompare length leak, token entropy, gossip capacity logging, and idle expiryiko e25424dFix multi-hop gossip, URL injection via control chars, and auth scheme case sensitivityiko 1496a57Fix federation ack race, presence capacity, auth case, gossip spoofing, and URL injectioniko 715d1e2Fix timing side-channel, poll pagination, gossip capacity, federation ack scoping, error logging, and first-hop validationiko 964dd22Fix server gossip race, DoS, validation ordering, and status reportingiko fa9d38aFix messages not being received by threading poll cursor through client stateiko 1025ec4Fix server compilation by updating to fetch API and restructuring handlers for proper type checkingiko 346c12eAdd hex validation for encryptedBlob and improve ForwardMessage duplicate detectioniko f651cb7Add length validation for originServer in ForwardMessageiko 31ee934Add hex validation for messageIds in ForwardMessage, AckMessages, and FederationAckiko 027ee68Fix 6 validation bugs in server.knot: add hex validation for federation-sourced keys and gossip events, add length validation for message IDs, remove redundant checkiko 75f4a12Fix 7 server.knot bugs: hex validation, poll authorization, gossip fromServer check, and message age calculationiko 0cabbfdFix 7 server.knot bugs: offline gossip peer loss, missing hex validation, clock skew intolerance, fromServer validation, senderServers overfitting, poll unauthorized ambiguity, and FederationAck message scopeiko 242926bFix 3 server.knot bugs: poll cursor regression, missing offline gossip broadcasts, and superseded event re-propagationiko c6062b1Fix 7 server.knot bugs: poll cursor regression, missing length validations, stale gossip re-propagation, deduplication inconsistencies, and lazy offline gossip broadcastiko 5ec38a4Fix 6 server.knot bugs: offline timestamp estimation, fromServer validation, LookupPresence unauthorized response, AckMessages empty IDs, Poll duplicate gossip, and input size validationiko 7945fd9Fix 5 server.knot bugs: poll cursor race, stale gossip overwrites, missing offline events, LookupPresence misleading response, and message sequencingiko d1663a6Fix 4 server.knot federation bugs: gossip bounce-back, event filtering, messageId deduplication, and sender trackingiko 574d190Fix 6 server.knot bugs: poll cursor pagination, input validation, challenge consumption, federation ack reliability, and gossip propagationiko 100c1bcFix 6 server.knot bugs: session cap eviction, input validation, poll cursor pagination, VerifyAuth race, ForwardMessage field validation, and FederationAck message cleanupiko 0ed7a46Fix 8 server.knot bugs: message expiry boundaries, empty field validation, federation ack reliability, session caps, cursor pagination, and gossip tie-breakingiko dbb5b8dFix 5 server.knot bugs: gossip online/offline conflict, ForwardMessage originServer validation, FederationAck fromServer verification, missing auth gossip broadcast, and LookupPresence auth detectioniko be5ec10Fix 5 server.knot bugs: ForwardMessage timestamp bounds, gossip timestamp validation, gossip re-propagation, and HTTPS federation URLsiko