gwadaking/radarsargasses
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security: appliquer les findings de l'audit OWASP (H1→B3)

Browse Source 
H1 — trusted_proxies RFC-1918 dans framework.yaml : rate limiting
     opérationnel derrière Traefik (IP client réelle, pas IP Traefik)

H2 — En-têtes HTTP dans Caddyfile : X-Frame-Options DENY,
     X-Content-Type-Options nosniff, Referrer-Policy, Permissions-Policy,
     suppression header Server

H3 — API Platform docs désactivés en when@prod (Swagger UI, ReDoc)

M1 — Rate limiter sur DELETE /api/push/subscribe (manquant)
M2 — Validation FILTER_VALIDATE_URL sur endpoint push avant stockage
M3 — APP_ENV=prod dans backend/.env (était dev — risque si .env.local absent)
M4 — Limite 4096 octets sur le body JSON (FeedbackController + PushController)
M5 — Service Worker : open redirect corrigé (targetUrl validé contre l'origine)

B1 — robots.txt créé (bloque /api/ et /bundles/)
B3 — --time-limit=3600 sur les workers Messenger (rotation + libération mémoire)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Gwadaking
2026-04-10 00:49:15 -04:00
parent 0d9c85e71b
commit cda9a7a8ff
9 changed files with 57 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
backend/src/Controller/PushController.php
View File

@@ -49,12 +49,20 @@ class PushController extends AbstractController
return $this->json(['error' => 'Too many requests'], 429);
}
if (strlen($request->getContent()) > 4096) {
return $this->json(['error' => 'Request body too large'], 413);
}
$data = json_decode($request->getContent(), true);
if (!isset($data['endpoint'], $data['keys']['auth'], $data['keys']['p256dh'])) {
return $this->json(['error' => 'Missing required fields'], 422);
}
if (!filter_var($data['endpoint'], FILTER_VALIDATE_URL)) {
return $this->json(['error' => 'Invalid endpoint URL'], 422);
}
// Upsert : si l'endpoint existe déjà, on met à jour
$repo = $this->em->getRepository(PushSubscription::class);
$sub = $repo->findOneBy(['endpoint' => $data['endpoint']]) ?? new PushSubscription();
@@ -81,6 +89,11 @@ class PushController extends AbstractController
#[Route('/subscribe', name: 'unsubscribe', methods: ['DELETE'])]
public function unsubscribe(Request $request): JsonResponse
{
$limiter = $this->apiPushLimiter->create($request->getClientIp() ?? 'unknown');
if (!$limiter->consume()->isAccepted()) {
return $this->json(['error' => 'Too many requests'], 429);
}
$data = json_decode($request->getContent(), true);
if (empty($data['endpoint'])) {
return $this->json(['error' => 'Missing endpoint'], 422);