UMBRA

History

Kyle Pope 44e6c8e3e5 Fix 3 pentest findings: lockout status disclosure, timing side-channel, XFF trust scope

F-01 (passkeys.py): Add constant-time DB no-op on login/begin when username not
found. Without it the absent credential-fetch query makes the "no user" path
measurably faster, leaking username existence via timing.

F-02 (session.py, auth.py, passkeys.py, totp.py): Change check_account_lockout
from HTTP 423 to 401 — status-code analysis can no longer distinguish a locked
account from an invalid credential. record_failed_login now returns remaining
attempt count; callers use it for progressive UX warnings (<=3 attempts left,
and on the locking attempt) without changing the 401 status code visible to
attackers. Session-lock 423 path in get_current_user is unaffected.

F-03 (nginx.conf): Replace set_real_ip_from 0.0.0.0/0 with RFC 1918 ranges
(172.16.0.0/12, 10.0.0.0/8) to prevent external clients from spoofing
X-Forwarded-For to bypass rate limiting.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-03-18 01:01:19 +08:00

audit.py

Extract real client IP from proxy headers instead of Docker bridge IP

2026-03-01 19:20:07 +08:00

auth.py

Address code review findings across all phases

2026-03-13 00:19:33 +08:00

calendar_sharing.py

Fix CompoundSelect chaining: use standalone union_all()

2026-03-16 20:39:40 +08:00

connection.py

Action QA findings: refactor sync to accept resolved values