Fixes from the dev-branch security/correctness audit (full report kept untracked under docs/_archive/). Ported the master-audit fixes to dev's code, plus dev-only findings:
Bootstrap: reject zip-slip / path-traversal archive members before writing.
xmrig updater: fail closed when a signature is required but no key is pinned.
Lite server URLs: reject remote http:// (strict 127.0.0.0/8 loopback check).
Lite controller: propagate encrypt/decryptsave() failure instead of reporting success.
File perms: xmrig config and exported-keys dump written 0600; chat_messages.sqlite (+ WAL/SHM) owner-only.
Clipboard secret cleared on shutdown.
CSV/spreadsheet formula injection neutralized in transaction export.
Build pipeline: build-from-source lite backend (removed the self-attested CMake signature gate), pinned + verified appimagetool, verified Sapling params, build.sh exits 0 on success.
Console callRaw scrubs the response buffer/tree so dumpprivkey/z_exportkey output doesn't linger in freed heap.
Seed creator wipes the mnemonic on the failure path.
Findings were adversarially re-verified; that pass caught (and I fixed) a prefix-match bypass in the loopback check. Deliberately deferred (documented in the report): chat header-metadata AEAD binding (wire-protocol / interop decision) and an offline-rooted bootstrap signature.
UI polish + default-pool cleanup (c53b7f7)
Overview: inset the address-row favorite (star) button so it doesn't touch the card edge.
Mining: removed pool.dragonx.cc from the built-in default pools (pool.dragonx.is is the sole default).
Mining: middle-truncate saved pool-URL / payout-address dropdown rows so a full z-address doesn't overlap the delete (X) button.
Mining: fixed thread-grid cells overflowing the card at >100% display scaling.
Testing
Full-node build clean; ctest suite passes (1/1). Windows full-node + lite release builds were verified earlier on this branch.
## Summary
Two commits, based on `dev`.
### Security audit remediations (`bcee4bf`)
Fixes from the dev-branch security/correctness audit (full report kept untracked under `docs/_archive/`). Ported the master-audit fixes to dev's code, plus dev-only findings:
- **Bootstrap**: reject zip-slip / path-traversal archive members before writing.
- **xmrig updater**: fail closed when a signature is required but no key is pinned.
- **HTTP metadata fetch**: 16 MiB cap (covers updaters + exchange/price data).
- **RPC client**: explicit `SSL_VERIFYPEER`/`VERIFYHOST` + 256 MiB response cap.
- **Lite server URLs**: reject remote `http://` (strict 127.0.0.0/8 loopback check).
- **Lite controller**: propagate `encrypt`/`decrypt` `save()` failure instead of reporting success.
- **File perms**: xmrig config and exported-keys dump written `0600`; `chat_messages.sqlite` (+ WAL/SHM) owner-only.
- **Clipboard** secret cleared on shutdown.
- **CSV/spreadsheet formula injection** neutralized in transaction export.
- **Build pipeline**: build-from-source lite backend (removed the self-attested CMake signature gate), pinned + verified appimagetool, verified Sapling params, `build.sh` exits 0 on success.
- **Console `callRaw`** scrubs the response buffer/tree so `dumpprivkey`/`z_exportkey` output doesn't linger in freed heap.
- **Seed creator** wipes the mnemonic on the failure path.
Findings were adversarially re-verified; that pass caught (and I fixed) a prefix-match bypass in the loopback check. Deliberately deferred (documented in the report): chat header-metadata AEAD binding (wire-protocol / interop decision) and an offline-rooted bootstrap signature.
### UI polish + default-pool cleanup (`c53b7f7`)
- **Overview**: inset the address-row favorite (star) button so it doesn't touch the card edge.
- **Mining**: removed `pool.dragonx.cc` from the built-in default pools (`pool.dragonx.is` is the sole default).
- **Mining**: middle-truncate saved pool-URL / payout-address dropdown rows so a full z-address doesn't overlap the delete (X) button.
- **Mining**: fixed thread-grid cells overflowing the card at >100% display scaling.
## Testing
Full-node build clean; `ctest` suite passes (1/1). Windows full-node + lite release builds were verified earlier on this branch.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Dev-branch audit (docs/_archive/security-audit-dev-2026-07-22.md) re-found the
master issues (absent on dev) plus new ones in dev-only code. Applied here;
full-node build + test suite green; the subtle fixes were adversarially re-verified.
Ported from the master remediation (adapted to dev's code):
- bootstrap: reject zip-slip / path-traversal archive members (isSafeArchivePath)
before writing (S2-1). (dev already fail-closes on a missing checksum.)
- xmrig updater: fail closed when a signature is required but no key is pinned (F1-1).
- http_download.httpGetString: 16 MiB hard cap + MAXFILESIZE on the shared
metadata/price fetch (F1-2 / caps the updater + exchange paths at one site).
- rpc_client: explicit SSL_VERIFYPEER/VERIFYHOST (F4-1) and a 256 MiB response
cap in WriteCallback (F4-3).
- lite_connection_service: reject remote http:// lite servers, loopback only (L1-1).
Loopback is matched by a strict dotted-decimal 127.0.0.0/8 check (not a
startsWith("127.") prefix, which would wrongly accept 127.0.0.1.evil.com), with
userinfo/fragment stripping.
- lite controller: propagate encrypt/decrypt save() failure instead of reporting
success (F7-1).
- xmrig_manager: chmod(0600) the pool config before writing secrets (F5-2).
- app: clear the copied secret from the OS clipboard on shutdown (F3b-1).
- export_transactions: neutralize CSV/spreadsheet formula injection (F13-1).
- build pipeline: build-from-source lite backend + remove the self-attested
CMake signature gate (F15-1); pinned+verified appimagetool (F15-3/4);
verified Sapling params in setup.sh (F15-6); build.sh exits 0 on success.
(F14-1 empty-quoted-arg and F8-2 NUL-termination were already fixed on dev.)
Dev-only findings:
- rpc_client.callRaw: scrub the raw buffer + parsed tree (templated scrubJsonSecrets
for ordered_json) so console dumpprivkey/z_exportkey keys don't linger in freed
heap (N1-1).
- seed_wallet_creator: wipe the exported mnemonic on the failure path so a discarded
failed result never carries a live seed (W1-2).
- export_all_keys: write the plaintext key dump 0600 + atomically via
writeFileAtomically (U1-2).
- chat_database: restrict chat_messages.sqlite and its WAL/SHM sidecars to owner-only (C3-1).
Not done (need a decision, documented in the report):
- Chat header metadata (cid/z/p) rides outside the AEAD (C1/C2) — binding it is a
wire-protocol change requiring SilentDragonXLite interop review.
- Bootstrap lacks an offline-rooted signature (S2-2 residual) — needs signing infra.
- Console scrollback retains console-typed key-export output in plaintext (N1-1
residual) — inherent to an echoing console; would need output redaction.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- balance: inset the address-row favorite (star) button by the card's inner
padding so it mirrors the left margin instead of hugging the card edge.
- mining: remove pool.dragonx.cc from the built-in default pools (pool.dragonx.is
is now the sole default); update the pool-registry test accordingly.
- mining: middle-truncate saved pool-URL and payout-address dropdown rows (new
shared material::TruncateToWidth helper) so a full z-address no longer runs
under the trailing delete (X) button.
- mining: fix the thread-grid cells overflowing the card at >100% display
scaling — the reserved Mine-button width used a raw clamp that didn't scale;
scale it by dp so cols is estimated correctly (no-op at 100%).
Full-node build + test suite green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
DanS
merged commit 21da9e75fc into dev2026-07-22 17:19:29 -05:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Summary
Two commits, based on
dev.Security audit remediations (
bcee4bf)Fixes from the dev-branch security/correctness audit (full report kept untracked under
docs/_archive/). Ported the master-audit fixes to dev's code, plus dev-only findings:SSL_VERIFYPEER/VERIFYHOST+ 256 MiB response cap.http://(strict 127.0.0.0/8 loopback check).encrypt/decryptsave()failure instead of reporting success.0600;chat_messages.sqlite(+ WAL/SHM) owner-only.build.shexits 0 on success.callRawscrubs the response buffer/tree sodumpprivkey/z_exportkeyoutput doesn't linger in freed heap.Findings were adversarially re-verified; that pass caught (and I fixed) a prefix-match bypass in the loopback check. Deliberately deferred (documented in the report): chat header-metadata AEAD binding (wire-protocol / interop decision) and an offline-rooted bootstrap signature.
UI polish + default-pool cleanup (
c53b7f7)pool.dragonx.ccfrom the built-in default pools (pool.dragonx.isis the sole default).Testing
Full-node build clean;
ctestsuite passes (1/1). Windows full-node + lite release builds were verified earlier on this branch.🤖 Generated with Claude Code
Dev-branch audit (docs/_archive/security-audit-dev-2026-07-22.md) re-found the master issues (absent on dev) plus new ones in dev-only code. Applied here; full-node build + test suite green; the subtle fixes were adversarially re-verified. Ported from the master remediation (adapted to dev's code): - bootstrap: reject zip-slip / path-traversal archive members (isSafeArchivePath) before writing (S2-1). (dev already fail-closes on a missing checksum.) - xmrig updater: fail closed when a signature is required but no key is pinned (F1-1). - http_download.httpGetString: 16 MiB hard cap + MAXFILESIZE on the shared metadata/price fetch (F1-2 / caps the updater + exchange paths at one site). - rpc_client: explicit SSL_VERIFYPEER/VERIFYHOST (F4-1) and a 256 MiB response cap in WriteCallback (F4-3). - lite_connection_service: reject remote http:// lite servers, loopback only (L1-1). Loopback is matched by a strict dotted-decimal 127.0.0.0/8 check (not a startsWith("127.") prefix, which would wrongly accept 127.0.0.1.evil.com), with userinfo/fragment stripping. - lite controller: propagate encrypt/decrypt save() failure instead of reporting success (F7-1). - xmrig_manager: chmod(0600) the pool config before writing secrets (F5-2). - app: clear the copied secret from the OS clipboard on shutdown (F3b-1). - export_transactions: neutralize CSV/spreadsheet formula injection (F13-1). - build pipeline: build-from-source lite backend + remove the self-attested CMake signature gate (F15-1); pinned+verified appimagetool (F15-3/4); verified Sapling params in setup.sh (F15-6); build.sh exits 0 on success. (F14-1 empty-quoted-arg and F8-2 NUL-termination were already fixed on dev.) Dev-only findings: - rpc_client.callRaw: scrub the raw buffer + parsed tree (templated scrubJsonSecrets for ordered_json) so console dumpprivkey/z_exportkey keys don't linger in freed heap (N1-1). - seed_wallet_creator: wipe the exported mnemonic on the failure path so a discarded failed result never carries a live seed (W1-2). - export_all_keys: write the plaintext key dump 0600 + atomically via writeFileAtomically (U1-2). - chat_database: restrict chat_messages.sqlite and its WAL/SHM sidecars to owner-only (C3-1). Not done (need a decision, documented in the report): - Chat header metadata (cid/z/p) rides outside the AEAD (C1/C2) — binding it is a wire-protocol change requiring SilentDragonXLite interop review. - Bootstrap lacks an offline-rooted signature (S2-2 residual) — needs signing infra. - Console scrollback retains console-typed key-export output in plaintext (N1-1 residual) — inherent to an echoing console; would need output redaction. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>