m1saka/dsh-web
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix audit findings: lock architecture, security, deployment hardening

Browse Source 
Close all 14 findings from the codebase audit (1 high, 5 medium, 8 low):

- Locking: replace the global API and workspace mutexes with per-instance
  and per-user keyed locks (new internal/api/locks.go) so a slow restore,
  upgrade or transfer no longer blocks unrelated users or instances; move
  Docker I/O out of the build queue and invalidate concurrent image-index
  observations with a generation counter; serialize instance deletion
  behind in-flight creation.
- Security: equalize login timing for unknown usernames, periodically
  purge expired sessions/refresh tokens/lock rows, URL-encode orphan IDs
  in the frontend, upgrade vitest 3.x->5.x to clear 3 npm audit
  vulnerabilities (2 critical RCE).
- Deployment: add a -healthcheck mode probing /healthz (used by Dockerfile
  HEALTHCHECK and compose), make ADMIN_PASSWORD optional in compose with
  removal guidance after first start, exclude test scripts from the image,
  and cap panel resources (cpus: 2, pids_limit: 512).
- Reliability: check rows.Err() on admin listing loops, surface intent
  polling errors without sticking, disable close during in-flight create.

Verified: go build/vet, full go test -race -count=1 ./..., frontend
tsc build + 32 tests, npm audit 0, compose config, real-container
healthcheck.
This commit is contained in:
m1saka
2026-10-13 20:59:28 +08:00
parent 85332bbc56
commit 66abb76318
33 changed files with 1065 additions and 540 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/api/files.go
+50 -49
View File
@@ -13,7 +13,6 @@ import (
"path"
"sort"
"strings"
"sync"
"syscall"
"time"
@@ -34,8 +33,6 @@ const (
var zipSlots = make(chan struct{}, 4)
var errZipLimit = errors.New("archive limit exceeded")
var workspaceMu sync.Mutex
func renameNoReplace(root *os.Root, old, next string) error {
anchor, err := root.Open(".")
if err != nil {
@@ -155,37 +152,41 @@ func (a *API) workspace(w http.ResponseWriter, r *http.Request) {
return
}
if instanceID != "" {
// Pin this instance's home without holding the global lifecycle lock
// Pin this instance's home without holding the instance lifecycle lock
// across client reads/writes. Lifecycle mutations reject active leases.
a.mu.Lock()
inst := a.instanceLocks.Acquire(instanceID)
i, e := a.s.GetInstance(instanceID)
if e != nil || i.UID != u.ID {
a.mu.Unlock()
inst.Release()
fail(w, 404, "instance not found")
return
}
if r.Method != http.MethodGet && (i.Status == "error" || a.upgradeRecoveryRequired(i)) {
a.mu.Unlock()
inst.Release()
fail(w, 409, "instance requires recovery")
return
}
a.readersMu.Lock()
if a.workspaceReaders == nil {
a.workspaceReaders = make(map[string]int)
}
a.workspaceReaders[instanceID]++
a.mu.Unlock()
a.readersMu.Unlock()
inst.Release()
defer func() {
a.mu.Lock()
a.workspaceReaders[instanceID]--
if a.workspaceReaders[instanceID] == 0 {
delete(a.workspaceReaders, instanceID)
a.readersMu.Lock()
if a.workspaceReaders != nil {
a.workspaceReaders[instanceID]--
if a.workspaceReaders[instanceID] == 0 {
delete(a.workspaceReaders, instanceID)
}
}
a.mu.Unlock()
a.readersMu.Unlock()
}()
}
workspaceMu.Lock()
user := a.userLocks.Acquire(u.ID)
root, err := a.openWorkspace(u, instanceID)
workspaceMu.Unlock()
user.Release()
if err != nil {
fail(w, 500, "storage unavailable")
return
@@ -195,7 +196,7 @@ func (a *API) workspace(w http.ResponseWriter, r *http.Request) {
case "usage":
a.wsUsage(w, r, root, u)
case "tree":
a.wsTree(w, r, root)
a.wsTree(w, r, root, u)
case "mkdir":
a.wsMkdir(w, r, root, u)
case "rename":
@@ -223,9 +224,9 @@ func (a *API) wsUsage(w http.ResponseWriter, r *http.Request, root *os.Root, u s
fail(w, 405, "method not allowed")
return
}
workspaceMu.Lock()
user := a.userLocks.Acquire(u.ID)
n, e := a.userUsage(u)
workspaceMu.Unlock()
user.Release()
if e != nil {
fail(w, 500, "usage unavailable")
return
@@ -233,12 +234,12 @@ func (a *API) wsUsage(w http.ResponseWriter, r *http.Request, root *os.Root, u s
writeJSON(w, map[string]int64{"used_bytes": n, "quota_bytes": u.Quota})
}
func (a *API) wsTree(w http.ResponseWriter, r *http.Request, root *os.Root) {
workspaceMu.Lock()
locked := true
func (a *API) wsTree(w http.ResponseWriter, r *http.Request, root *os.Root, u store.User) {
user := a.userLocks.Acquire(u.ID)
locked := user
defer func() {
if locked {
workspaceMu.Unlock()
if locked != nil {
locked.Release()
}
}()
if r.Method != http.MethodGet {
@@ -281,8 +282,8 @@ func (a *API) wsTree(w http.ResponseWriter, r *http.Request, root *os.Root) {
out = append(out, map[string]any{"name": de.Name(), "path": p, "is_dir": st.IsDir(), "size": sz, "mod_time": st.ModTime()})
}
sort.Slice(out, func(i, j int) bool { return out[i]["name"].(string) < out[j]["name"].(string) })
workspaceMu.Unlock()
locked = false
locked.Release()
locked = nil
writeJSON(w, out)
}
@@ -299,11 +300,11 @@ func (a *API) wsMkdir(w http.ResponseWriter, r *http.Request, root *os.Root, u s
return
}
p, e := safeRel(x.Path)
workspaceMu.Lock()
locked := true
user := a.userLocks.Acquire(u.ID)
locked := user
defer func() {
if locked {
workspaceMu.Unlock()
if locked != nil {
locked.Release()
}
}()
if e != nil || p == "." || rootSafe(root, path.Dir(p), false) != nil {
@@ -318,8 +319,8 @@ func (a *API) wsMkdir(w http.ResponseWriter, r *http.Request, root *os.Root, u s
_ = f.Chown(1000, 1000)
f.Close()
}
workspaceMu.Unlock()
locked = false
locked.Release()
locked = nil
a.s.AddAudit(u.ID, "workspace.mkdir", p, "")
writeJSON(w, map[string]bool{"ok": true})
}
@@ -339,11 +340,11 @@ func (a *API) wsRename(w http.ResponseWriter, r *http.Request, root *os.Root, u
}
p, e := safeRel(x.Path)
q, e2 := safeRel(x.NewPath)
workspaceMu.Lock()
locked := true
user := a.userLocks.Acquire(u.ID)
locked := user
defer func() {
if locked {
workspaceMu.Unlock()
if locked != nil {
locked.Release()
}
}()
if e != nil || e2 != nil || p == "." || q == "." || rootSafe(root, p, false) != nil || rootSafe(root, path.Dir(q), false) != nil {
@@ -363,18 +364,18 @@ func (a *API) wsRename(w http.ResponseWriter, r *http.Request, root *os.Root, u
fail(w, 400, "rename failed")
return
}
workspaceMu.Unlock()
locked = false
locked.Release()
locked = nil
a.s.AddAudit(u.ID, "workspace.rename", p, q)
writeJSON(w, map[string]bool{"ok": true})
}
func (a *API) wsDelete(w http.ResponseWriter, r *http.Request, root *os.Root, u store.User) {
workspaceMu.Lock()
locked := true
user := a.userLocks.Acquire(u.ID)
locked := user
defer func() {
if locked {
workspaceMu.Unlock()
if locked != nil {
locked.Release()
}
}()
if r.Method != http.MethodDelete {
@@ -402,8 +403,8 @@ func (a *API) wsDelete(w http.ResponseWriter, r *http.Request, root *os.Root, u
fail(w, 400, "delete failed")
return
}
workspaceMu.Unlock()
locked = false
locked.Release()
locked = nil
a.s.AddAudit(u.ID, "workspace.delete", p, "")
writeJSON(w, map[string]bool{"ok": true})
}
@@ -437,11 +438,11 @@ func (a *API) wsUpload(w http.ResponseWriter, r *http.Request, root *os.Root, u
return
}
defer r.MultipartForm.RemoveAll()
workspaceMu.Lock()
locked := true
user := a.userLocks.Acquire(u.ID)
locked := user
defer func() {
if locked {
workspaceMu.Unlock()
if locked != nil {
locked.Release()
}
}()
dir, e := safeRel(r.FormValue("path"))
@@ -503,8 +504,8 @@ func (a *API) wsUpload(w http.ResponseWriter, r *http.Request, root *os.Root, u
fail(w, 400, "upload failed")
return
}
workspaceMu.Unlock()
locked = false
locked.Release()
locked = nil
a.s.AddAudit(u.ID, "workspace.upload", target, "")
writeJSON(w, map[string]bool{"ok": true})
}