Security audit 2026-10-15: relay fixes #258

2026-10-15T13:21:42Z

extant2000git commented

2026-10-15 13:21:42 +00:00

Fixes from the 2026-10-15 audit, with no change to any shape the apps read.

Block list hides unlisted accounts that are not the caller's buddies (shows User #id, empty slug).
No vouch for a suspended account.
Federation outbound calls run the outbound address guard.
Control characters in email addresses refused; mailer strips them from headers.
Key log proof, device and subject reads metered at 3600 per address per hour.

Left as is: email_taken (both apps depend on it), strict account tokens (needs the account service change first), credential expiry and current-password checks (need an app update first).

swift test: 1015 of 1015, 6 new.

🤖 Generated with Claude Code

Fixes from the 2026-10-15 audit, with no change to any shape the apps read. - Block list hides unlisted accounts that are not the caller's buddies (shows User #id, empty slug). - No vouch for a suspended account. - Federation outbound calls run the outbound address guard. - Control characters in email addresses refused; mailer strips them from headers. - Key log proof, device and subject reads metered at 3600 per address per hour. Left as is: email_taken (both apps depend on it), strict account tokens (needs the account service change first), credential expiry and current-password checks (need an app update first). swift test: 1015 of 1015, 6 new. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

extant2000git added 1 commit 2026-10-15 13:21:43 +00:00

Security audit 2026-10-15: relay fixes

ci / checks (pull_request) Successful in 12s

Details

ci / swift (pull_request) Successful in 9m10s

Details

ci / image (pull_request) Successful in 1m49s

Details

ci / deploy (pull_request) Skipped

Details

842f11e952

- Block list: a blocked account that is unlisted and not on the caller's
  buddy list comes back as "User #<id>" with an empty slug. Rows and shape
  are unchanged, so unblock still works in both apps.
- Vouching: a suspended account can no longer be issued a vouch (403
  account_suspended).
- Federation: outbound deposit, get and fetch run the outbound address
  guard, with allowlisted peers exempt as in PeerDirectory.
- Email: control characters in an address are refused as bad_email, and
  the mailer refuses such a recipient and strips them from headers.
- Key log: inclusion, consistency, device and subject reads are metered at
  3600 per address per hour each, like the head.

Not changed: email_taken stays (both apps map it), strict account tokens
stay off until the account service stamps iss, aud and jti, and the
credential and current-password hardening needs an app update first.

swift test: 1015 of 1015 pass, 6 new.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

extant2000git merged commit 41580da291 into main

2026-10-15 13:35:03 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: extant2000/flamenet-relay#258