7690f07a2b
Comprehensive security hardening from audit findings: - Add validation tags to all DTO request structs (max lengths, ranges, enums) - Replace unsafe type assertions with MustGetAuthUser helper across all handlers - Remove query-param token auth from admin middleware (prevents URL token leakage) - Add request validation calls in handlers that were missing c.Validate() - Remove goroutines in handlers (timezone update now synchronous) - Add sanitize middleware and path traversal protection (path_utils) - Stop resetting admin passwords on migration restart - Warn on well-known default SECRET_KEY - Add ~30 new test files covering security regressions, auth safety, repos, and services - Add deploy/ config, audit digests, and AUDIT_FINDINGS documentation Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
31 lines
1.9 KiB
Markdown
31 lines
1.9 KiB
Markdown
# Digest 3: admin routes, apperrors, config, database, dto/requests, dto/responses (first half)
|
|
|
|
### admin/routes.go (483 lines)
|
|
- Route ordering: users DELETE "/:id" before "/bulk" — "/bulk" matches as id param
|
|
- Line 454: Uses os.Getenv instead of Viper config
|
|
- Line 460-462: url.Parse failure returns silently, no logging
|
|
- Line 467-469: Proxy errors not surfaced (always returns nil)
|
|
|
|
### apperrors/errors.go (98 lines) - Clean. Error types with Wrap/Unwrap.
|
|
### apperrors/handler.go (67 lines) - c.JSON error returns discarded (minor)
|
|
|
|
### config/config.go (427 lines)
|
|
- Line 339: Hardcoded debug secret key "change-me-in-production-secret-key-12345"
|
|
- Lines 311-312: Comments say wrong UTC times (says 8PM/9AM, actually 2PM/3PM)
|
|
|
|
### database/database.go (468 lines)
|
|
- **SECURITY**: Line 372-382: Hardcoded bcrypt hash for GoAdmin with password "admin" — migration RESETS password every run
|
|
- **SECURITY**: Line 447-463: Hardcoded admin@mycrib.com / admin123 — password reset on every migration
|
|
- Line 182+: Multiple db.Exec errors unchecked for index creation
|
|
- Line 100-102: WithTransaction coupled to global db variable
|
|
|
|
### dto/requests/auth.go (66 lines) - LoginRequest min=1 password (intentional for login)
|
|
### dto/requests/contractor.go (37 lines) - Rating has no min/max validation bounds
|
|
### dto/requests/document.go (47 lines) - ImageURLs no length limit, Description no max length
|
|
### dto/requests/residence.go (59 lines) - Bedrooms/SquareFootage accept negative values, ExpiresInHours no validation
|
|
### dto/requests/task.go (110 lines) - Rating no bounds, ImageURLs no length limit, CustomIntervalDays no min
|
|
|
|
### dto/responses/auth.go (190 lines) - Clean. Proper nil checks on Profile.
|
|
### dto/responses/contractor.go (131 lines) - TaskCount depends on preloaded Tasks association
|
|
### dto/responses/document.go (126 lines) - Line 101: CreatedBy accessed as value type (fragile if changed to pointer)
|