Security fixes: SSRF, staff role escalation, SPA-only gating, throttling, encrypted keys
Findings from the audit (50-check harness across guest/user/uploader/staff/ admin) and their fixes: - SSRF: 'Download to Library' and the staged-upload resolve path fetched any http(s) URL. services.validate_remote_url now enforces the e621 media allowlist and open_remote re-validates every redirect hop; the download-task create endpoint and the guest proxy use them, so internal addresses (127.0.0.1, LAN, metadata) are rejected with 400. - Privilege escalation: staff could promote users to staff and demote other staff. Role changes across the staff boundary now require an admin, matching the account-deletion rules; the Users page hides what the backend would refuse. - SPA-only gating: /api/storage/ and /api/duplicates/* were readable by any authenticated account (absolute paths, duplicate groups) while the SPA only shows them to uploaders. They now require CanUpload. - Throttling (REST_FRAMEWORK, env-overridable, counted in Redis): anon 120/min, user 600/min, login 5/min, register 20/hour, guest e621 proxy 60/hour. Login now goes through a throttled view. - e621 API keys are encrypted at rest with a Fernet key derived from SECRET_KEY (apps/accounts/crypto.py); a data migration encrypts existing rows and the column widens first. Reads decrypt transparently, legacy plaintext still works, and a changed SECRET_KEY reads as 'not configured' instead of leaking. Rotating SECRET_KEY now invalidates stored keys as well as signed media URLs. - Hardening: the server refuses to start with DEBUG=False while SECRET_KEY is still the development default. Verified: corrected harness 50/50 (guest visibility, IDOR, signed-URL tamper/expiry, staged-upload/similarity privacy, role matrix, SSRF), login throttles at the 6th attempt with 429, anon polling unaffected, the guest proxy still reaches allowlisted hosts, live e621 auth works with the decrypted key, and DB rows hold only ciphertext.
This commit is contained in:
@@ -0,0 +1,48 @@
|
||||
"""Symmetric encryption for secrets stored at rest, keyed by SECRET_KEY.
|
||||
|
||||
Used for the per-user e621 API keys: a database dump (or backup) alone does
|
||||
not expose them. Rotating SECRET_KEY makes existing values undecryptable,
|
||||
exactly like the signed media URLs stop verifying — users then re-enter
|
||||
their e621 key.
|
||||
"""
|
||||
|
||||
import base64
|
||||
import hashlib
|
||||
|
||||
from cryptography.fernet import Fernet, InvalidToken
|
||||
from django.conf import settings
|
||||
|
||||
PREFIX = "enc:"
|
||||
|
||||
|
||||
def _fernet() -> Fernet:
|
||||
# Derive a stable Fernet key from the project secret.
|
||||
digest = hashlib.sha256(
|
||||
f"j621-secret-v1:{settings.SECRET_KEY}".encode()
|
||||
).digest()
|
||||
return Fernet(base64.urlsafe_b64encode(digest))
|
||||
|
||||
|
||||
def encrypt_secret(value: str) -> str:
|
||||
"""Encrypt for storage; empty stays empty and already-encrypted passes through."""
|
||||
if not value:
|
||||
return ""
|
||||
if value.startswith(PREFIX):
|
||||
return value
|
||||
return PREFIX + _fernet().encrypt(value.encode()).decode()
|
||||
|
||||
|
||||
def decrypt_secret(value: str) -> str:
|
||||
"""Decrypt a stored value; legacy plaintext passes through.
|
||||
|
||||
Returns "" when the value cannot be decrypted (e.g. SECRET_KEY changed),
|
||||
which reads as "not configured" and asks the user for the key again.
|
||||
"""
|
||||
if not value:
|
||||
return ""
|
||||
if not value.startswith(PREFIX):
|
||||
return value
|
||||
try:
|
||||
return _fernet().decrypt(value[len(PREFIX) :].encode()).decode()
|
||||
except InvalidToken:
|
||||
return ""
|
||||
@@ -0,0 +1,34 @@
|
||||
from django.db import migrations, models
|
||||
|
||||
|
||||
def encrypt_existing_keys(apps, schema_editor):
|
||||
"""Store existing e621 API keys encrypted (idempotent)."""
|
||||
from apps.accounts.crypto import encrypt_secret
|
||||
|
||||
User = apps.get_model("accounts", "User")
|
||||
for user in User.objects.exclude(e621_api_key="").iterator():
|
||||
if user.e621_api_key.startswith("enc:"):
|
||||
continue
|
||||
user.e621_api_key = encrypt_secret(user.e621_api_key)
|
||||
user.save(update_fields=["e621_api_key"])
|
||||
|
||||
|
||||
def noop(apps, schema_editor):
|
||||
pass
|
||||
|
||||
|
||||
class Migration(migrations.Migration):
|
||||
dependencies = [
|
||||
("accounts", "0005_user_preferences"),
|
||||
]
|
||||
|
||||
operations = [
|
||||
# Ciphertext is longer than the plaintext key, so widen the column
|
||||
# before encrypting existing rows.
|
||||
migrations.AlterField(
|
||||
model_name="user",
|
||||
name="e621_api_key",
|
||||
field=models.CharField(blank=True, default="", max_length=400),
|
||||
),
|
||||
migrations.RunPython(encrypt_existing_keys, noop),
|
||||
]
|
||||
@@ -23,14 +23,22 @@ class User(AbstractUser):
|
||||
related_name="+",
|
||||
)
|
||||
e621_username = models.CharField(max_length=100, blank=True, default="")
|
||||
e621_api_key = models.CharField(max_length=100, blank=True, default="")
|
||||
# Stored encrypted (see apps/accounts/crypto.py): never the plaintext key.
|
||||
e621_api_key = models.CharField(max_length=400, blank=True, default="")
|
||||
e621_base_url = models.CharField(max_length=200, default="https://e621.net")
|
||||
# Per-user browse preferences (landing page, default filters, grid size).
|
||||
preferences = models.JSONField(default=dict, blank=True)
|
||||
|
||||
@property
|
||||
def e621_api_key_plain(self):
|
||||
"""The decrypted e621 key ("" when it cannot be decrypted)."""
|
||||
from .crypto import decrypt_secret
|
||||
|
||||
return decrypt_secret(self.e621_api_key)
|
||||
|
||||
@property
|
||||
def e621_configured(self):
|
||||
return bool(self.e621_username and self.e621_api_key)
|
||||
return bool(self.e621_username and self.e621_api_key_plain)
|
||||
|
||||
@property
|
||||
def can_upload(self):
|
||||
|
||||
@@ -1,9 +1,9 @@
|
||||
from django.urls import path
|
||||
from rest_framework.authtoken.views import obtain_auth_token
|
||||
|
||||
from .views import (
|
||||
AvatarView,
|
||||
E621CredentialsView,
|
||||
LoginView,
|
||||
LogoutView,
|
||||
MeView,
|
||||
PreferencesView,
|
||||
@@ -12,7 +12,7 @@ from .views import (
|
||||
|
||||
urlpatterns = [
|
||||
path("register/", RegisterView.as_view(), name="register"),
|
||||
path("token/", obtain_auth_token, name="login"),
|
||||
path("token/", LoginView.as_view(), name="login"),
|
||||
path("logout/", LogoutView.as_view(), name="logout"),
|
||||
path("me/", MeView.as_view(), name="me"),
|
||||
path("avatar/", AvatarView.as_view(), name="avatar"),
|
||||
|
||||
@@ -2,14 +2,17 @@ import logging
|
||||
|
||||
from rest_framework import mixins, status, viewsets
|
||||
from rest_framework.authtoken.models import Token
|
||||
from rest_framework.authtoken.views import ObtainAuthToken
|
||||
from rest_framework.permissions import AllowAny, IsAuthenticated
|
||||
from rest_framework.response import Response
|
||||
from rest_framework.throttling import ScopedRateThrottle
|
||||
from rest_framework.views import APIView
|
||||
from django.db.models import Count, Q
|
||||
|
||||
from apps.core.permissions import IsAppStaff
|
||||
from apps.library.models import MediaItem
|
||||
|
||||
from .crypto import encrypt_secret
|
||||
from .models import User
|
||||
from .serializers import (
|
||||
E621CredentialsSerializer,
|
||||
@@ -23,8 +26,17 @@ from .serializers import (
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
|
||||
class LoginView(ObtainAuthToken):
|
||||
"""Token login, rate limited per IP to slow down credential stuffing."""
|
||||
|
||||
throttle_classes = [ScopedRateThrottle]
|
||||
throttle_scope = "login"
|
||||
|
||||
|
||||
class RegisterView(APIView):
|
||||
permission_classes = [AllowAny]
|
||||
throttle_classes = [ScopedRateThrottle]
|
||||
throttle_scope = "register"
|
||||
|
||||
def post(self, request):
|
||||
serializer = RegisterSerializer(data=request.data)
|
||||
@@ -64,7 +76,7 @@ class E621CredentialsView(APIView):
|
||||
def _payload(self, user):
|
||||
return {
|
||||
"username": user.e621_username,
|
||||
"api_key": user.e621_api_key,
|
||||
"api_key": user.e621_api_key_plain,
|
||||
"base_url": user.e621_base_url,
|
||||
"configured": user.e621_configured,
|
||||
}
|
||||
@@ -78,7 +90,7 @@ class E621CredentialsView(APIView):
|
||||
data = serializer.validated_data
|
||||
user = request.user
|
||||
user.e621_username = data["username"].strip()
|
||||
user.e621_api_key = data["api_key"].strip()
|
||||
user.e621_api_key = encrypt_secret(data["api_key"].strip())
|
||||
user.e621_base_url = (
|
||||
(data.get("base_url") or "https://e621.net").strip().rstrip("/")
|
||||
)
|
||||
@@ -172,13 +184,28 @@ class UserViewSet(
|
||||
|
||||
def update(self, request, *args, **kwargs):
|
||||
user = self.get_object()
|
||||
actor = request.user
|
||||
serializer = UserUpdateSerializer(data=request.data)
|
||||
serializer.is_valid(raise_exception=True)
|
||||
data = serializer.validated_data
|
||||
|
||||
update_fields = []
|
||||
if "role" in data:
|
||||
user.role = data["role"]
|
||||
new_role = data["role"]
|
||||
# Same rule as account deletion: only admins may move accounts
|
||||
# across the staff boundary (granting or revoking staff).
|
||||
if (
|
||||
not actor.is_superuser
|
||||
and new_role != user.role
|
||||
and (user.is_app_staff or new_role == User.ROLE_STAFF)
|
||||
):
|
||||
return Response(
|
||||
{
|
||||
"detail": "Only an admin can change staff roles.",
|
||||
},
|
||||
status=status.HTTP_403_FORBIDDEN,
|
||||
)
|
||||
user.role = new_role
|
||||
update_fields.append("role")
|
||||
if "avatar_j_id" in data:
|
||||
item, error = resolve_avatar_item(data.get("avatar_j_id"))
|
||||
|
||||
Reference in New Issue
Block a user