Security audit remediations + Overview/Mining UI polish #1

DanS · 2026-07-22T17:15:25-05:00

DanS commented

2026-07-22 17:15:25 -05:00

Summary

Two commits, based on dev.

Security audit remediations (`bcee4bf`)

Fixes from the dev-branch security/correctness audit (full report kept untracked under docs/_archive/). Ported the master-audit fixes to dev's code, plus dev-only findings:

Bootstrap: reject zip-slip / path-traversal archive members before writing.
xmrig updater: fail closed when a signature is required but no key is pinned.
HTTP metadata fetch: 16 MiB cap (covers updaters + exchange/price data).
RPC client: explicit SSL_VERIFYPEER/VERIFYHOST + 256 MiB response cap.
Lite server URLs: reject remote http:// (strict 127.0.0.0/8 loopback check).
Lite controller: propagate encrypt/decrypt save() failure instead of reporting success.
File perms: xmrig config and exported-keys dump written 0600; chat_messages.sqlite (+ WAL/SHM) owner-only.
Clipboard secret cleared on shutdown.
CSV/spreadsheet formula injection neutralized in transaction export.
Build pipeline: build-from-source lite backend (removed the self-attested CMake signature gate), pinned + verified appimagetool, verified Sapling params, build.sh exits 0 on success.
Console callRaw scrubs the response buffer/tree so dumpprivkey/z_exportkey output doesn't linger in freed heap.
Seed creator wipes the mnemonic on the failure path.

Findings were adversarially re-verified; that pass caught (and I fixed) a prefix-match bypass in the loopback check. Deliberately deferred (documented in the report): chat header-metadata AEAD binding (wire-protocol / interop decision) and an offline-rooted bootstrap signature.

UI polish + default-pool cleanup (`c53b7f7`)

Overview: inset the address-row favorite (star) button so it doesn't touch the card edge.
Mining: removed pool.dragonx.cc from the built-in default pools (pool.dragonx.is is the sole default).
Mining: middle-truncate saved pool-URL / payout-address dropdown rows so a full z-address doesn't overlap the delete (X) button.
Mining: fixed thread-grid cells overflowing the card at >100% display scaling.

Testing

Full-node build clean; ctest suite passes (1/1). Windows full-node + lite release builds were verified earlier on this branch.

🤖 Generated with Claude Code

## Summary Two commits, based on `dev`. ### Security audit remediations (`bcee4bf`) Fixes from the dev-branch security/correctness audit (full report kept untracked under `docs/_archive/`). Ported the master-audit fixes to dev's code, plus dev-only findings: - **Bootstrap**: reject zip-slip / path-traversal archive members before writing. - **xmrig updater**: fail closed when a signature is required but no key is pinned. - **HTTP metadata fetch**: 16 MiB cap (covers updaters + exchange/price data). - **RPC client**: explicit `SSL_VERIFYPEER`/`VERIFYHOST` + 256 MiB response cap. - **Lite server URLs**: reject remote `http://` (strict 127.0.0.0/8 loopback check). - **Lite controller**: propagate `encrypt`/`decrypt` `save()` failure instead of reporting success. - **File perms**: xmrig config and exported-keys dump written `0600`; `chat_messages.sqlite` (+ WAL/SHM) owner-only. - **Clipboard** secret cleared on shutdown. - **CSV/spreadsheet formula injection** neutralized in transaction export. - **Build pipeline**: build-from-source lite backend (removed the self-attested CMake signature gate), pinned + verified appimagetool, verified Sapling params, `build.sh` exits 0 on success. - **Console `callRaw`** scrubs the response buffer/tree so `dumpprivkey`/`z_exportkey` output doesn't linger in freed heap. - **Seed creator** wipes the mnemonic on the failure path. Findings were adversarially re-verified; that pass caught (and I fixed) a prefix-match bypass in the loopback check. Deliberately deferred (documented in the report): chat header-metadata AEAD binding (wire-protocol / interop decision) and an offline-rooted bootstrap signature. ### UI polish + default-pool cleanup (`c53b7f7`) - **Overview**: inset the address-row favorite (star) button so it doesn't touch the card edge. - **Mining**: removed `pool.dragonx.cc` from the built-in default pools (`pool.dragonx.is` is the sole default). - **Mining**: middle-truncate saved pool-URL / payout-address dropdown rows so a full z-address doesn't overlap the delete (X) button. - **Mining**: fixed thread-grid cells overflowing the card at >100% display scaling. ## Testing Full-node build clean; `ctest` suite passes (1/1). Windows full-node + lite release builds were verified earlier on this branch. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

DanS added 2 commits 2026-07-22 17:15:25 -05:00

fix(security): apply audit remediations to dev (ported + dev-only) bcee4bfe72

Dev-branch audit (docs/_archive/security-audit-dev-2026-07-22.md) re-found the
master issues (absent on dev) plus new ones in dev-only code. Applied here;
full-node build + test suite green; the subtle fixes were adversarially re-verified.

Ported from the master remediation (adapted to dev's code):
- bootstrap: reject zip-slip / path-traversal archive members (isSafeArchivePath)
  before writing (S2-1). (dev already fail-closes on a missing checksum.)
- xmrig updater: fail closed when a signature is required but no key is pinned (F1-1).
- http_download.httpGetString: 16 MiB hard cap + MAXFILESIZE on the shared
  metadata/price fetch (F1-2 / caps the updater + exchange paths at one site).
- rpc_client: explicit SSL_VERIFYPEER/VERIFYHOST (F4-1) and a 256 MiB response
  cap in WriteCallback (F4-3).
- lite_connection_service: reject remote http:// lite servers, loopback only (L1-1).
  Loopback is matched by a strict dotted-decimal 127.0.0.0/8 check (not a
  startsWith("127.") prefix, which would wrongly accept 127.0.0.1.evil.com), with
  userinfo/fragment stripping.
- lite controller: propagate encrypt/decrypt save() failure instead of reporting
  success (F7-1).
- xmrig_manager: chmod(0600) the pool config before writing secrets (F5-2).
- app: clear the copied secret from the OS clipboard on shutdown (F3b-1).
- export_transactions: neutralize CSV/spreadsheet formula injection (F13-1).
- build pipeline: build-from-source lite backend + remove the self-attested
  CMake signature gate (F15-1); pinned+verified appimagetool (F15-3/4);
  verified Sapling params in setup.sh (F15-6); build.sh exits 0 on success.
  (F14-1 empty-quoted-arg and F8-2 NUL-termination were already fixed on dev.)

Dev-only findings:
- rpc_client.callRaw: scrub the raw buffer + parsed tree (templated scrubJsonSecrets
  for ordered_json) so console dumpprivkey/z_exportkey keys don't linger in freed
  heap (N1-1).
- seed_wallet_creator: wipe the exported mnemonic on the failure path so a discarded
  failed result never carries a live seed (W1-2).
- export_all_keys: write the plaintext key dump 0600 + atomically via
  writeFileAtomically (U1-2).
- chat_database: restrict chat_messages.sqlite and its WAL/SHM sidecars to owner-only (C3-1).

Not done (need a decision, documented in the report):
- Chat header metadata (cid/z/p) rides outside the AEAD (C1/C2) — binding it is a
  wire-protocol change requiring SilentDragonXLite interop review.
- Bootstrap lacks an offline-rooted signature (S2-2 residual) — needs signing infra.
- Console scrollback retains console-typed key-export output in plaintext (N1-1
  residual) — inherent to an echoing console; would need output redaction.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

fix(ui): overview/mining polish + default-pool cleanup c53b7f771e

- balance: inset the address-row favorite (star) button by the card's inner
  padding so it mirrors the left margin instead of hugging the card edge.
- mining: remove pool.dragonx.cc from the built-in default pools (pool.dragonx.is
  is now the sole default); update the pool-registry test accordingly.
- mining: middle-truncate saved pool-URL and payout-address dropdown rows (new
  shared material::TruncateToWidth helper) so a full z-address no longer runs
  under the trailing delete (X) button.
- mining: fix the thread-grid cells overflowing the card at >100% display
  scaling — the reserved Mine-button width used a raw clamp that didn't scale;
  scale it by dp so cols is estimated correctly (no-op at 100%).

Full-node build + test suite green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

DanS merged commit 21da9e75fc into dev

2026-07-22 17:19:29 -05:00

DanS referenced this issue from a commit

2026-07-22 17:19:31 -05:00

Merge pull request 'Security audit remediations + Overview/Mining UI polish' (#1) from fix/audit-remediations-dev into dev

DanS referenced this issue from a commit

2026-07-22 23:47:08 -05:00

Merge contacts table-view footer fix into dev (follow-up to #1)

DanS referenced this issue from a commit

2026-07-23 22:07:59 -05:00

feat(market): stat-tile group cards + grid fills available width and height

Sign in to join this conversation.