53 lines
2.4 KiB
Markdown
53 lines
2.4 KiB
Markdown
# Code-audit fix batch (2026-09)
|
|
|
|
Findings from the 2026-09-15 code audit, in shipping order. The systemd
|
|
cutover was explicitly deferred — the process stays on run.sh's nohup
|
|
model; only the restart mechanism's blast radius is fixed here.
|
|
|
|
## 1. login handler blocks the event loop (HIGH)
|
|
|
|
`login` is `async def`, so the anti-brute-force `time.sleep(0.5)` inside
|
|
the lockout check runs ON the event loop: every wrong password stalls
|
|
every in-flight request (all streams included) on the single worker.
|
|
Fix: make the handler a plain `def` (uvicorn runs it on the threadpool);
|
|
move the lockout logic into a side-effect-free `server/auth.py` so it is
|
|
unit-testable without booting the app. Regression test measures
|
|
`/api/cdn` latency while a wrong-password login is mid-sleep.
|
|
|
|
## 2. run.sh global pkill (HIGH)
|
|
|
|
`pkill -f "uvicorn .*app:app"` also matches the test server
|
|
(`uvicorn server.app:app --host 127.0.0.1 --port 8399`): an ani-web
|
|
restart kills running test sessions (and vice versa). Fix: PID file
|
|
(`server.pid`) becomes the primary kill path; any pattern fallback is
|
|
port-scoped to the real instance.
|
|
|
|
## 3. lockout is per-username only (MEDIUM)
|
|
|
|
Spreading failures across usernames bypasses the per-username lockout
|
|
entirely (and anyone can lock a known account for 15 min). Add a
|
|
per-IP failure budget (`ANIWEB_IP_FAILS` / window) on top of the
|
|
per-username lockout. Client IP = `request.client.host`; the reverse
|
|
proxy's `X-Forwarded-For` is consulted only when `ANIWEB_TRUST_XFF=1`
|
|
(set by run.sh), so a spoofed header can't widen or narrow the gate.
|
|
|
|
## 4. login is exempt from the CSRF header check (MEDIUM)
|
|
|
|
The custom-header check that makes cross-site form POSTs fail excludes
|
|
`/login`. The exemption is load-bearing only by accident (JSON body
|
|
content-type); login becomes covered by the same check as every other
|
|
mutation, and login.html sends the header.
|
|
|
|
## 5. dependencies unpinned (MEDIUM)
|
|
|
|
`curl_cffi` version churn = impersonation churn = silent upstream 403
|
|
waves. requirements.txt becomes a full freeze; bump deliberately.
|
|
|
|
## 6. live-upstream e2e gated off by default
|
|
|
|
The Playwright tests scrape and play real provider content — they go red
|
|
whenever a provider rotates or a title is taken down (observed repeatedly).
|
|
A suite that fails for non-regressions can't gate anything, so the default
|
|
run is now hermetic only; run the live e2e deliberately with
|
|
`ANIWEB_LIVE_TESTS=1`.
|