git.iko.soy/skrepka
on adeccc3 help sign in
adeccc3Fix four correctness and security bugs: lost federation acks on eviction, safeCompare for strings >256 chars, ForwardMessage duplicate check during pruning rate-limiting, and verifyMaintenanceAuth timing side-channeliko e59b702Fix five security and correctness bugs: poll cursor re-delivery, ackedIds eviction duplicate delivery, backgroundPrune missing federation retry, safeCompare timing leak, and verifyMaintenanceAuth timing side-channeliko 5a23463Fix three bugs: duplicate delivery on failed acks, long-poll deadline hang, and thundering herdiko 8815b21Fix SSRF via port-only hostnames, ackedIds batch eviction, and remove dead codeiko 9a8af83Fix pruning timer, stale gossip timestamp in long poll, and federation ack retryiko d7f8914Fix 5 security and correctness bugs: gossip re-propagation, long polling, offline event filtering, challenge replay, and silent ID dropsiko af04984Fix messageMaxAge, messageIds DoS, maintenance auth timing leak, hexDigit overflow, and per-request prune overheadiko e987c00Fix ackedIds unbounded growth, premature forward cleanup, and CGNAT hostname false positivesiko b157c1cFix serverHost normalization mismatch, forward retry data loss, safeCompare timing leak, and SSRF gapsiko 574bd2fFix leading-dot SSRF bypass, duplicate delivery after ack, and unclamped gossip TTLiko 3b2ae7bStop deleting messages on FederationAck to prevent message lossiko af34851Fix orphaned forward records for locally-delivered messages and remove dead codeiko ea729eaFix multicast SSRF gap, global session cap, gossip hex normalization, and octal false positivesiko 0079aa1Fix SSRF case/dot bypass, safeCompare timing leak, missing reserved ranges, federation ack loss, and timestamp clampingiko a1766bfFix SSRF bypass, safeCompare timing, challenge cap, retry backoff, and empty server nameiko 3d65e98Fix LookupPresence normalizeHex crash, safeCompare length handling, and genToken entropyiko 7c133a3Fix gossip batching overflow, multi-hop trust propagation, normalizeHex crash, forwards cap, IPv6 SSRF, federation retry, and gossip capacity reclaimiko d670413Fix safeCompare length leak, offline gossip trust bypass, hop-0 injection, federation retry, and per-recipient message capiko 5b68b19Fix safeCompare timing leak, federation ack message loss, gossip hop-0 rejection, federation retry, and gossip source spoofingiko 07b1accFix URL backslash injection, safeCompare length leak, token entropy, gossip capacity logging, and idle expiryiko e25424dFix multi-hop gossip, URL injection via control chars, and auth scheme case sensitivityiko 1496a57Fix federation ack race, presence capacity, auth case, gossip spoofing, and URL injectioniko 715d1e2Fix timing side-channel, poll pagination, gossip capacity, federation ack scoping, error logging, and first-hop validationiko 964dd22Fix server gossip race, DoS, validation ordering, and status reportingiko fa9d38aFix messages not being received by threading poll cursor through client stateiko 1025ec4Fix server compilation by updating to fetch API and restructuring handlers for proper type checkingiko 346c12eAdd hex validation for encryptedBlob and improve ForwardMessage duplicate detectioniko f651cb7Add length validation for originServer in ForwardMessageiko 31ee934Add hex validation for messageIds in ForwardMessage, AckMessages, and FederationAckiko 027ee68Fix 6 validation bugs in server.knot: add hex validation for federation-sourced keys and gossip events, add length validation for message IDs, remove redundant checkiko 75f4a12Fix 7 server.knot bugs: hex validation, poll authorization, gossip fromServer check, and message age calculationiko 0cabbfdFix 7 server.knot bugs: offline gossip peer loss, missing hex validation, clock skew intolerance, fromServer validation, senderServers overfitting, poll unauthorized ambiguity, and FederationAck message scopeiko 242926bFix 3 server.knot bugs: poll cursor regression, missing offline gossip broadcasts, and superseded event re-propagationiko c6062b1Fix 7 server.knot bugs: poll cursor regression, missing length validations, stale gossip re-propagation, deduplication inconsistencies, and lazy offline gossip broadcastiko 5ec38a4Fix 6 server.knot bugs: offline timestamp estimation, fromServer validation, LookupPresence unauthorized response, AckMessages empty IDs, Poll duplicate gossip, and input size validationiko 7945fd9Fix 5 server.knot bugs: poll cursor race, stale gossip overwrites, missing offline events, LookupPresence misleading response, and message sequencingiko d1663a6Fix 4 server.knot federation bugs: gossip bounce-back, event filtering, messageId deduplication, and sender trackingiko 574d190Fix 6 server.knot bugs: poll cursor pagination, input validation, challenge consumption, federation ack reliability, and gossip propagationiko 100c1bcFix 6 server.knot bugs: session cap eviction, input validation, poll cursor pagination, VerifyAuth race, ForwardMessage field validation, and FederationAck message cleanupiko 0ed7a46Fix 8 server.knot bugs: message expiry boundaries, empty field validation, federation ack reliability, session caps, cursor pagination, and gossip tie-breakingiko dbb5b8dFix 5 server.knot bugs: gossip online/offline conflict, ForwardMessage originServer validation, FederationAck fromServer verification, missing auth gossip broadcast, and LookupPresence auth detectioniko be5ec10Fix 5 server.knot bugs: ForwardMessage timestamp bounds, gossip timestamp validation, gossip re-propagation, and HTTPS federation URLsiko ea7c090Fix 7 server.knot bugs: federation message cleanup, multi-device sessions, timestamp validation, forward failures, and multi-server federationiko 9daf178Fix 5 server.knot bugs: TOCTOU race in Poll, unsafe federation acks, missing federated presence handling, unrecognized gossip events, and absent outbound message forwardingiko 9c8eda5Fix session management, pruning consistency, and presence federation in server.knotiko a4a36e1Fix 5 server.knot bugs: multi-server presence lookup, poll auth signaling, expired data pruning, and long-poll blockingiko a9574e5Fix Knot compiler type errors in response handlersiko 10935f1Fix race conditions and security issues in server.knotiko 4413596Implement long polling in Poll handler using atomic transactions with retryiko 6d59d9bUpdate server.knot to match Knot language spec: bind source relations before use, all IO before branchingiko