fix(security): apply audit remediations to dev (ported + dev-only)

Dev-branch audit (docs/_archive/security-audit-dev-2026-07-22.md) re-found the
master issues (absent on dev) plus new ones in dev-only code. Applied here;
full-node build + test suite green; the subtle fixes were adversarially re-verified.

Ported from the master remediation (adapted to dev's code):
- bootstrap: reject zip-slip / path-traversal archive members (isSafeArchivePath)
  before writing (S2-1). (dev already fail-closes on a missing checksum.)
- xmrig updater: fail closed when a signature is required but no key is pinned (F1-1).
- http_download.httpGetString: 16 MiB hard cap + MAXFILESIZE on the shared
  metadata/price fetch (F1-2 / caps the updater + exchange paths at one site).
- rpc_client: explicit SSL_VERIFYPEER/VERIFYHOST (F4-1) and a 256 MiB response
  cap in WriteCallback (F4-3).
- lite_connection_service: reject remote http:// lite servers, loopback only (L1-1).
  Loopback is matched by a strict dotted-decimal 127.0.0.0/8 check (not a
  startsWith("127.") prefix, which would wrongly accept 127.0.0.1.evil.com), with
  userinfo/fragment stripping.
- lite controller: propagate encrypt/decrypt save() failure instead of reporting
  success (F7-1).
- xmrig_manager: chmod(0600) the pool config before writing secrets (F5-2).
- app: clear the copied secret from the OS clipboard on shutdown (F3b-1).
- export_transactions: neutralize CSV/spreadsheet formula injection (F13-1).
- build pipeline: build-from-source lite backend + remove the self-attested
  CMake signature gate (F15-1); pinned+verified appimagetool (F15-3/4);
  verified Sapling params in setup.sh (F15-6); build.sh exits 0 on success.
  (F14-1 empty-quoted-arg and F8-2 NUL-termination were already fixed on dev.)

Dev-only findings:
- rpc_client.callRaw: scrub the raw buffer + parsed tree (templated scrubJsonSecrets
  for ordered_json) so console dumpprivkey/z_exportkey keys don't linger in freed
  heap (N1-1).
- seed_wallet_creator: wipe the exported mnemonic on the failure path so a discarded
  failed result never carries a live seed (W1-2).
- export_all_keys: write the plaintext key dump 0600 + atomically via
  writeFileAtomically (U1-2).
- chat_database: restrict chat_messages.sqlite and its WAL/SHM sidecars to owner-only (C3-1).

Not done (need a decision, documented in the report):
- Chat header metadata (cid/z/p) rides outside the AEAD (C1/C2) — binding it is a
  wire-protocol change requiring SilentDragonXLite interop review.
- Bootstrap lacks an offline-rooted signature (S2-2 residual) — needs signing infra.
- Console scrollback retains console-typed key-export output in plaintext (N1-1
  residual) — inherent to an echoing console; would need output redaction.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/util/bootstrap.cpp

@@ -31,6 +31,31 @@ static bool endsWith(const std::string& s, const std::string& suffix) {
     return s.compare(s.size() - suffix.size(), suffix.size(), suffix) == 0;
 }
 
+// Reject archive member names that would escape the extraction root (zip-slip).
+// The snapshot legitimately carries sub-paths (blocks/, chainstate/), so — unlike the
+// updaters, which flatten to baseName() — we keep the relative path but refuse any entry
+// that is absolute, drive/UNC-rooted, or contains a ".." component.
+static bool isSafeArchivePath(const std::string& name) {
+    if (name.empty()) return false;
+    std::string n = name;
+    std::replace(n.begin(), n.end(), '\\', '/');   // normalize Windows separators
+    if (n.front() == '/') return false;             // absolute POSIX path
+    const char c0 = n[0];
+    if (n.size() >= 2 && n[1] == ':' &&
+        ((c0 >= 'A' && c0 <= 'Z') || (c0 >= 'a' && c0 <= 'z')))
+        return false;                               // Windows drive letter (C:...)
+    size_t start = 0;
+    while (start <= n.size()) {
+        const size_t slash = n.find('/', start);
+        const std::string comp =
+            n.substr(start, slash == std::string::npos ? std::string::npos : slash - start);
+        if (comp == "..") return false;             // path traversal component
+        if (slash == std::string::npos) break;
+        start = slash + 1;
+    }
+    return true;
+}
+
 static size_t writeFileCallback(void* contents, size_t size, size_t nmemb, void* userp) {
     size_t total = size * nmemb;
     FILE* fp = static_cast<FILE*>(userp);
@@ -383,6 +408,16 @@ bool Bootstrap::extract(const std::string& zipPath, const std::string& dataDir)
 
         std::string filename = stat.m_filename;
 
+        // *** SECURITY: reject zip-slip / path-traversal entries before building any path ***
+        // A legitimate snapshot from the project host never contains these; an entry that does
+        // indicates a malicious/corrupt archive, so abort rather than silently skip.
+        if (!isSafeArchivePath(filename)) {
+            DEBUG_LOGF("[Bootstrap] Unsafe archive path rejected: %s\n", filename.c_str());
+            setProgress(State::Failed, "Refusing to extract unsafe archive entry: " + filename);
+            mz_zip_reader_end(&zip);
+            return false;
+        }
+
         // *** CRITICAL: Skip wallet.dat ***
         if (filename == "wallet.dat" || endsWith(filename, "/wallet.dat")) {
             DEBUG_LOGF("[Bootstrap] Skipping wallet.dat (protected)\n");

src/util/http_download.cpp

@@ -19,10 +19,19 @@ namespace util {
 
 namespace {
 
+// Cap for in-memory text/JSON responses (release metadata, price/candle data). Far above any
+// legitimate body, but bounds memory if a hostile/MITM'd server streams an unbounded response.
+constexpr std::size_t kMaxMetadataBytes = 16u * 1024 * 1024;
+
 size_t writeStringCb(void* contents, size_t size, size_t nmemb, void* userp)
 {
-    static_cast<std::string*>(userp)->append(static_cast<char*>(contents), size * nmemb);
-    return size * nmemb;
+    auto* s = static_cast<std::string*>(userp);
+    const size_t n = size * nmemb;
+    // Hard cap: a chunked response omits Content-Length, so CURLOPT_MAXFILESIZE cannot catch it —
+    // aborting here (short count) makes curl fail the transfer instead of exhausting memory.
+    if (s->size() + n > kMaxMetadataBytes) return 0;
+    s->append(static_cast<char*>(contents), n);
+    return n;
 }
 
 size_t writeFileCb(void* contents, size_t size, size_t nmemb, void* userp)
@@ -52,6 +61,7 @@ std::string httpGetString(const std::string& url, const char* logTag)
     curl_easy_setopt(curl, CURLOPT_USERAGENT, "ObsidianDragon/1.0");
     curl_easy_setopt(curl, CURLOPT_TIMEOUT, 30L);
     curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT, 15L);
+    curl_easy_setopt(curl, CURLOPT_MAXFILESIZE_LARGE, static_cast<curl_off_t>(kMaxMetadataBytes));  // reject oversized metadata
     curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 1L);
     curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 2L);
     const CURLcode res = curl_easy_perform(curl);

src/util/xmrig_updater.cpp

@@ -314,6 +314,12 @@ void XmrigUpdater::installResolved(const std::string& targetDir, const XmrigRele
                     return;
                 }
             }
+        } else if (kXmrigRequireSignature) {
+            // Signatures are required but no key is pinned in this build: fail closed rather than
+            // silently downgrading to checksum-only (the checksum is same-origin as the archive).
+            fs::remove(zipPath, ec);
+            setProgress(State::Failed, "No signing key is pinned in this build — refusing to install.");
+            return;
         }
     }