Cybersecurity-Projects

Commit Graph

Author	SHA1	Message	Date
CarterPerez-dev	2c033c58f2	fix(canary): webhook sender blocks SSRF to private/loopback/IMDS hosts Audit F3: validateURL checked scheme/host/userinfo but never resolved the host, so an operator-supplied webhook_url could point at the canary's own Redis (redis:6379), Postgres, link-local IMDS (169.254.169.254), or any RFC1918 host on the docker network or VPS subnet — a classic confused-deputy SSRF triggered by self-triggering a token after creation. validateURL now resolves the hostname (or parses a literal IP) and rejects loopback, RFC1918, CGNAT, link-local, multicast, unspecified, IMDS, and IPv6 unique-local. The default HTTP client also installs a DialContext that re-checks the dialed IP for defense-in-depth against DNS rebinding. The Config gains an AllowPrivateHosts flag (default false) that test code opts into when targeting httptest.NewServer.	2026-05-17 19:08:01 -04:00
CarterPerez-dev	0757d9f196	feat(canary): event + notify domain — contracts, senders, services Lays the domain layer for Phase 10 notification dispatch. - event/contract.go: NotifyInfo (token-shape DTO that breaks the would-be event→notify→token cycle), Notifier interface, TokenIncrementer interface, Store interface (Insert+UpdateNotifyStatus+PruneToLimit). - token.Token.NotifyInfo() helper bridges *token.Token → event.NotifyInfo for the main.go adapter. - notify/types.go: Sender + StatusWriter interfaces. - notify.Service: per-channel sender registry, async fire-and-forget Notify with bounded sendTimeout, WaitGroup for graceful drain, status writeback (sent / failed) on the configured StatusWriter. - telegram.Sender: POST /bot{TOKEN}/sendMessage with MarkdownV2-escaped body, cenkalti/backoff/v5 retry (3 tries / 30s window), permanent on 4xx, 10s overall + 5s connect timeouts. Note: spec body said parse_mode=Markdown but escape table is the V2 set; using MarkdownV2 keeps the escape rules consistent. - webhook.Sender: POST user URL with versioned JSON envelope (§10.4), optional HMAC-SHA256 signing via X-Canary-Signature, URL validation at the call site (rejects non-http(s), missing host, userinfo). Same retry/timeout policy as telegram. - event.Service: Record(ctx, info, evt) inserts → IncrementTriggerCount → Redis SetNX dedup gate (15m TTL, fail-open on Redis error). First trigger calls notifier; duplicates INCR + UpdateNotifyStatus(deduped). - event.Service.RunRetentionLoop(ctx, interval, limit) tickered prune. Adds cenkalti/backoff/v5 + miniredis/v2 to go.mod for backoff API and unit-test Redis fakes.	2026-05-14 00:30:42 -04:00

Author

SHA1

Message

Date

CarterPerez-dev

2c033c58f2

fix(canary): webhook sender blocks SSRF to private/loopback/IMDS hosts

Audit F3: validateURL checked scheme/host/userinfo but never resolved the
host, so an operator-supplied webhook_url could point at the canary's own
Redis (redis:6379), Postgres, link-local IMDS (169.254.169.254), or any
RFC1918 host on the docker network or VPS subnet — a classic confused-deputy
SSRF triggered by self-triggering a token after creation.

validateURL now resolves the hostname (or parses a literal IP) and rejects
loopback, RFC1918, CGNAT, link-local, multicast, unspecified, IMDS, and
IPv6 unique-local. The default HTTP client also installs a DialContext that
re-checks the dialed IP for defense-in-depth against DNS rebinding. The
Config gains an AllowPrivateHosts flag (default false) that test code opts
into when targeting httptest.NewServer.

2026-05-17 19:08:01 -04:00

CarterPerez-dev

0757d9f196

feat(canary): event + notify domain — contracts, senders, services

Lays the domain layer for Phase 10 notification dispatch.

- event/contract.go: NotifyInfo (token-shape DTO that breaks the would-be
  event→notify→token cycle), Notifier interface, TokenIncrementer interface,
  Store interface (Insert+UpdateNotifyStatus+PruneToLimit).
- token.Token.NotifyInfo() helper bridges *token.Token → event.NotifyInfo
  for the main.go adapter.
- notify/types.go: Sender + StatusWriter interfaces.
- notify.Service: per-channel sender registry, async fire-and-forget
  Notify with bounded sendTimeout, WaitGroup for graceful drain, status
  writeback (sent / failed) on the configured StatusWriter.
- telegram.Sender: POST /bot{TOKEN}/sendMessage with MarkdownV2-escaped
  body, cenkalti/backoff/v5 retry (3 tries / 30s window), permanent on
  4xx, 10s overall + 5s connect timeouts. Note: spec body said
  parse_mode=Markdown but escape table is the V2 set; using MarkdownV2
  keeps the escape rules consistent.
- webhook.Sender: POST user URL with versioned JSON envelope (§10.4),
  optional HMAC-SHA256 signing via X-Canary-Signature, URL validation
  at the call site (rejects non-http(s), missing host, userinfo). Same
  retry/timeout policy as telegram.
- event.Service: Record(ctx, info, evt) inserts → IncrementTriggerCount
  → Redis SetNX dedup gate (15m TTL, fail-open on Redis error). First
  trigger calls notifier; duplicates INCR + UpdateNotifyStatus(deduped).
- event.Service.RunRetentionLoop(ctx, interval, limit) tickered prune.

Adds cenkalti/backoff/v5 + miniredis/v2 to go.mod for backoff API and
unit-test Redis fakes.

2026-05-14 00:30:42 -04:00

2 Commits