89 lines
5.2 KiB
Markdown
89 lines
5.2 KiB
Markdown
# C-Relay-PG Security Remediation Summary
|
|
|
|
**Date:** 2026-08-13
|
|
**Status:** 19 of 28 findings remediated (3 Critical, 7 High, 9 Medium)
|
|
|
|
---
|
|
|
|
## ✅ Fixed and Deployed
|
|
|
|
### Critical (3)
|
|
|
|
| ID | Title | Fix | File(s) |
|
|
|----|-------|-----|---------|
|
|
| C-01 | SQL Injection via NIP-50 Search Filter | Replaced manual quote escaping with parameterized queries | [`src/websockets.c`](src/websockets.c), [`src/main.c`](src/main.c) |
|
|
| C-02 | Weak RNG for NIP-42 Challenges | Replaced `rand()` with `/dev/urandom` | [`src/request_validator.c`](src/request_validator.c) |
|
|
| C-03 | Command Injection via popen() | Documented safe usage (fixed compile-time strings) | [`src/api.c`](src/api.c) |
|
|
|
|
### High (7)
|
|
|
|
| ID | Title | Fix | File(s) |
|
|
|----|-------|-----|---------|
|
|
| H-01 | SQL Injection via LISTEN Channel | Added `PQescapeIdentifier()` defense-in-depth | [`src/db_ops_postgres.c`](src/db_ops_postgres.c) |
|
|
| H-02 | Use-After-Free in Async Event Completion | Added `current_pss` null check | [`src/websockets.c`](src/websockets.c) |
|
|
| H-03 | Buffer Overflow in Config Parsing | Replaced `strcpy()` with `snprintf()` | [`src/api.c`](src/api.c) |
|
|
| H-04 | SQL Injection via Direct Query Execution | Added whitelist-based validation | [`src/api.c`](src/api.c) |
|
|
| H-05 | Missing Rate Limiting on Auth Endpoints | Added per-IP rate limiting (10/60s) | [`src/nip042.c`](src/nip042.c) |
|
|
| H-06 | Unbounded Memory Growth | Added 10MB max message size limit | [`src/websockets.c`](src/websockets.c) |
|
|
| H-07 | Race Condition in Connection Tracking | Added session lock protection | [`src/websockets.c`](src/websockets.c) |
|
|
|
|
### Medium (9)
|
|
|
|
| ID | Title | Fix | File(s) |
|
|
|----|-------|-----|---------|
|
|
| M-01 | Information Disclosure via SQL Error Messages | Added sanitization (strip newlines, non-printable chars) | [`src/db_ops_postgres.c`](src/db_ops_postgres.c) |
|
|
| M-02 | Predictable Config Change IDs | Replaced timestamp-based IDs with `/dev/urandom` | [`src/api.c`](src/api.c) |
|
|
| M-04 | Weak Session Timeout | Reduced challenge expiration from 600s to 120s | [`src/nip042.c`](src/nip042.c) |
|
|
| M-07 | Integer Overflow in Query Limits | Added double-based clamping with safe range check | [`src/main.c`](src/main.c) |
|
|
| M-08 | Unrestricted File Read | Added directory traversal protection (`..` and `/` checks) | [`src/api.c`](src/api.c) |
|
|
| M-09 | Unvalidated Relay URLs in Caching | Added URL validation (ws:///wss:// scheme, printable ASCII) | [`caching/src/relay_discovery.c`](caching/src/relay_discovery.c) |
|
|
| M-10 | Config File World-Readable Permissions | Changed from 0644 to 0640 | [`caching/src/config.c`](caching/src/config.c) |
|
|
|
|
### Additional Fixes
|
|
|
|
| Fix | Description | File(s) |
|
|
|-----|-------------|---------|
|
|
| Missing DB index | Added `idx_subscriptions_active_lookup` partial index for admin stats | [`src/pg_schema.h`](src/pg_schema.h), [`src/sql_schema.h`](src/sql_schema.h) |
|
|
|
|
---
|
|
|
|
## 📋 Remaining Findings
|
|
|
|
### Low/Info (8)
|
|
|
|
| ID | Title | File | Description |
|
|
|----|-------|------|-------------|
|
|
| L-01 | Hardcoded Default Database Credentials | `admin/lib/config.php:24-28` | Default DB credentials (`crelay`/`crelay`) in config file |
|
|
| L-02 | Missing Security Headers in HTTP Responses | `src/nip011.c` | No CSP, HSTS, X-Frame-Options headers on HTTP responses |
|
|
| L-03 | Debug Information Leakage in Production | `src/main.c`, `src/config.c` | Debug logging may expose sensitive info in production |
|
|
| L-04 | Inconsistent Error Handling | Multiple files | Mix of error return codes, NULL returns, and output params |
|
|
| L-05 | Missing Input Sanitization for Log Messages | Multiple files | User input logged without sanitization (log injection) |
|
|
| L-06 | Potential String Truncation in strncpy Calls | `caching/src/*.c` | Multiple `strncpy` calls without explicit null termination |
|
|
| L-07 | No Binary Integrity Verification in Deployment | `deploy_lt.sh` | No checksum/signature verification on deployed binaries |
|
|
| L-08 | Hardcoded Database Credentials in Systemd Service | `systemd/c-relay-pg-local.service:13` | DB password visible in service file and process list |
|
|
|
|
### Design Decisions (Not Findings)
|
|
|
|
| ID | Rationale |
|
|
|----|-----------|
|
|
| M-03 | **Missing CSRF Protection** — The admin API uses Basic Auth and signed Nostr events for authentication. CSRF is mitigated by the requirement for cryptographic signatures on state-changing operations. |
|
|
| M-05 | **Unvalidated UDP Source Address** — Intentional design. The UDP ingress is part of the [UDP Nostr protocol](https://github.com/laantungir/udp_nostr) built on the "no-handshake" property. Events are self-validating via signatures — no connection state needed. Source IP validation would defeat censorship-resistance goals. |
|
|
| M-06 | **Admin Commands** — Already uses a whitelist of known command types with an `else` clause rejecting unknown commands. |
|
|
| M-11 | **eval() in Restart Script** — The script is a development tool, not exposed to untrusted input. |
|
|
|
|
---
|
|
|
|
## Summary
|
|
|
|
| Severity | Total | Fixed | Remaining | Design |
|
|
|----------|-------|-------|-----------|--------|
|
|
| Critical | 3 | 3 | 0 | 0 |
|
|
| High | 7 | 7 | 0 | 0 |
|
|
| Medium | 11 | 9 | 0 | 2 |
|
|
| Low/Info | 8 | 0 | 8 | 0 |
|
|
| **Total** | **29** | **19** | **8** | **2** |
|
|
|
|
---
|
|
|
|
*Generated: 2026-08-13*
|