[low] Hardening, grouped #15

New issue

Open

opened 2026-10-18 15:51:56 +00:00 by jfro · 0 comments

jfro commented

2026-10-18 15:51:56 +00:00

Owner

Severity: low
Affects: main and jtk/ebook-management (items marked ebook branch are only there)

oidc_controller.ex:148 logs the full user_info map (PII) on error; :175 logs email. Log sub/ids only.
library_of_congress_provider.ex:123 parses remote XML with :xmerl_scan.string (entity expansion, makes atoms). Switch to Saxy like the ebook parsers.
metadata_extractor.ex:211,249 (ebook branch): pdfinfo/pdftoppm run with no timeout, so a bad PDF can hang a worker. Wrap them in a Task with a timeout. (Args are passed as a list, so no shell injection.)
router.ex (ebook branch): oban_dashboard has no resolver, so access depends only on the HTTP pipeline. Add an Oban.Web.Resolver that checks for admin.
The scan worker's Path.wildcard follows symlinks, so a symlink named *.pdf in a library can serve any file through /ebooks/:id/download. Skip symlinks that point outside the library root.
provider_token (OIDC access token) is stored in plain text in users; drop it if it's unused.
AdminLive.mount (admin_live.ex:33) and AdminSettingsLive (admin_settings_live.ex:42) log inspect(current_scope) at info on every mount, so email/provider_uid land in the logs (secrets are redact: true). Fix: drop those lines or log the user id at debug.

Found by Nye's audit, 2026-10-18 (static review of main @1d89af4 and jtk/ebook-management @43a849e).

**Severity:** low **Affects:** main and jtk/ebook-management (items marked ebook branch are only there) - oidc_controller.ex:148 logs the full user_info map (PII) on error; :175 logs email. Log sub/ids only. - library_of_congress_provider.ex:123 parses remote XML with :xmerl_scan.string (entity expansion, makes atoms). Switch to Saxy like the ebook parsers. - metadata_extractor.ex:211,249 (ebook branch): pdfinfo/pdftoppm run with no timeout, so a bad PDF can hang a worker. Wrap them in a Task with a timeout. (Args are passed as a list, so no shell injection.) - router.ex (ebook branch): oban_dashboard has no resolver, so access depends only on the HTTP pipeline. Add an Oban.Web.Resolver that checks for admin. - The scan worker's Path.wildcard follows symlinks, so a symlink named *.pdf in a library can serve any file through /ebooks/:id/download. Skip symlinks that point outside the library root. - provider_token (OIDC access token) is stored in plain text in users; drop it if it's unused. - AdminLive.mount (admin_live.ex:33) and AdminSettingsLive (admin_settings_live.ex:42) log inspect(current_scope) at info on every mount, so email/provider_uid land in the logs (secrets are redact: true). Fix: drop those lines or log the user id at debug. --- _Found by Nye's audit, 2026-10-18 (static review of main @1d89af4 and jtk/ebook-management @43a849e)._

jfro added the

labels

2026-10-18 15:51:56 +00:00

jfro referenced this issue

2026-10-18 15:53:32 +00:00

feat: ebook libraries, scanning, matching and downloads #17

jfro referenced this issue

2026-10-18 16:23:37 +00:00