m1saka/dsh-web
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix audit findings: lock architecture, security, deployment hardening

Browse Source 
Close all 14 findings from the codebase audit (1 high, 5 medium, 8 low):

- Locking: replace the global API and workspace mutexes with per-instance
  and per-user keyed locks (new internal/api/locks.go) so a slow restore,
  upgrade or transfer no longer blocks unrelated users or instances; move
  Docker I/O out of the build queue and invalidate concurrent image-index
  observations with a generation counter; serialize instance deletion
  behind in-flight creation.
- Security: equalize login timing for unknown usernames, periodically
  purge expired sessions/refresh tokens/lock rows, URL-encode orphan IDs
  in the frontend, upgrade vitest 3.x->5.x to clear 3 npm audit
  vulnerabilities (2 critical RCE).
- Deployment: add a -healthcheck mode probing /healthz (used by Dockerfile
  HEALTHCHECK and compose), make ADMIN_PASSWORD optional in compose with
  removal guidance after first start, exclude test scripts from the image,
  and cap panel resources (cpus: 2, pids_limit: 512).
- Reliability: check rows.Err() on admin listing loops, surface intent
  polling errors without sticking, disable close during in-flight create.

Verified: go build/vet, full go test -race -count=1 ./..., frontend
tsc build + 32 tests, npm audit 0, compose config, real-container
healthcheck.
This commit is contained in:
m1saka
2026-10-13 20:59:28 +08:00
parent 85332bbc56
commit 66abb76318
33 changed files with 1065 additions and 540 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/api/runtime.go
+29 -15
View File
@@ -130,8 +130,12 @@ func (a *API) instances(w http.ResponseWriter, r *http.Request) {
}
func (a *API) createRuntime(ctx context.Context, u store.User, i store.Instance, trustedHost string) (store.Instance, error) {
a.mu.Lock()
defer a.mu.Unlock()
// The instance row is visible to its owner while creating, so hold the
// instance lock for the whole creation: a concurrent DELETE or file lease
// then waits instead of interleaving with container setup. Concurrent
// creations of different instances remain independent.
inst := a.instanceLocks.Acquire(i.ID)
defer inst.Release()
if _, err := a.s.GetInstance(i.ID); err != nil {
return i, errors.New("instance reservation unavailable")
}
@@ -317,8 +321,8 @@ func (a *API) instance(w http.ResponseWriter, r *http.Request) {
return
}
if action == "" && r.Method == "DELETE" {
a.mu.Lock()
defer a.mu.Unlock()
inst := a.instanceLocks.Acquire(p[0])
defer inst.Release()
i, err = a.s.GetInstance(p[0])
if err != nil || i.UID != u.ID {
fail(w, 404, "not found")
@@ -328,7 +332,10 @@ func (a *API) instance(w http.ResponseWriter, r *http.Request) {
fail(w, 409, "instance requires recovery")
return
}
if a.workspaceReaders[i.ID] > 0 {
a.readersMu.Lock()
readers := a.workspaceReaders[i.ID]
a.readersMu.Unlock()
if readers > 0 {
fail(w, 409, "instance files busy; retry later")
return
}
@@ -359,8 +366,8 @@ func (a *API) instance(w http.ResponseWriter, r *http.Request) {
fail(w, 405, "method not allowed")
return
}
a.mu.Lock()
defer a.mu.Unlock()
inst := a.instanceLocks.Acquire(p[0])
defer inst.Release()
i, err = a.s.GetInstance(p[0])
if err != nil || i.UID != u.ID {
fail(w, 404, "not found")
@@ -370,7 +377,10 @@ func (a *API) instance(w http.ResponseWriter, r *http.Request) {
fail(w, 409, "instance requires recovery")
return
}
if a.workspaceReaders[i.ID] > 0 {
a.readersMu.Lock()
readers := a.workspaceReaders[i.ID]
a.readersMu.Unlock()
if readers > 0 {
fail(w, 409, "instance files busy; retry later")
return
}
@@ -740,14 +750,18 @@ func (a *API) proxy(w http.ResponseWriter, r *http.Request) {
fail(w, 401, "authentication required")
return
}
a.mu.Lock()
locked := true
p := strings.SplitN(strings.TrimPrefix(r.URL.Path, "/dsh/"), "/", 2)
if p[0] == "" {
fail(w, 404, "not found")
return
}
inst := a.instanceLocks.Acquire(p[0])
locked := inst
defer func() {
if locked {
a.mu.Unlock()
if locked != nil {
locked.Release()
}
}()
p := strings.SplitN(strings.TrimPrefix(r.URL.Path, "/dsh/"), "/", 2)
i, err := a.s.GetInstance(p[0])
if err != nil || i.UID != u.ID {
fail(w, 404, "not found")
@@ -807,8 +821,8 @@ func (a *API) proxy(w http.ResponseWriter, r *http.Request) {
return
}
cancel()
a.mu.Unlock()
locked = false
locked.Release()
locked = nil
proxy := runtimeReverseProxy(target, prefix, host, cookies)
a.invalidateRejectedRuntimeCookie(proxy, i, c.State.StartedAt, host, cookies)
if bridge {