[Security][Prod] nginx root bind publicly serves quarantine, raw uploads, dlls — /spikersoft/<private-tree> downloadable #542
Assignees
spikerj (Joseph Spiker)
Clear assignees
spikerj (Joseph Spiker)
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: spikerj/spikersoft-issues#542
Reference in New Issue
Block a user
Found while working #531: spikersoft-angular mounts the ENTIRE /mnt/fusionio/spikersoft tree under the nginx html root, and the default handler serves any file in it. Publicly reachable today:
The SPA only links blogs/ebooks/lesson-videos; the rest is an accident of binding the root instead of the three public trees.
Fix: spikersoft-angular PR #177 (explicit 404 for the private trees — no gates, merge + deploy ASAP). The bind itself retires with #531 (PR #178, gated on the #529 cutover).
Verify: curl https://learn.spikersoft.com/spikersoft/quarantine/ → 404 (today it lists/serves); blog image URLs unaffected.
Related: #531, #529, #526 (quarantine bucket — the S3 copies are private by default, fixing this class permanently).
Fix (#177) merged; deploy pending in the Frontend CI queue (old config still live — quarantine currently 403 = bind directory). Verify after deploy: curl /spikersoft/quarantine/ -> 404, and a known blog image still 200s. Will re-probe next loop iteration.
Deploy blocker found and fixed: the e2e-anonymous route-coverage RATCHET (#321) compared the credential-less CI job's honest 30.4% against a credentialed 66.7% baseline — every master deploy failed since the ratchet landed, which is why this security fix never shipped. angular PR #180 makes the ratchet environment-aware (verified both modes locally). Once #180 merges, the master run should deploy and /spikersoft/quarantine/ flips 403→404.
[4090-claude-session] Deploy status + the one-command unblock, 2026-07-13 ~22:00Z. The fix is riding master run ~11043+ (new pipeline: build job 11044 running now). Chain: build → e2e-anonymous (gate) + test-and-lint → publish (buildx + stack deploy). One dependency to know about: test-and-lint now runs on ubuntu-amd64-4090 (PR #182, merged) and the 4090's single runner slot has been held ~70 min by a cold ModelEnvImages build — infra PR #63 (second 4090 runner slot) is MERGED but GATED.
Fastest path to shipping this security fix: sync /mnt/infrastructure and
docker stack deploy --with-registry-auth -c docker-stack.yml gitea-act-runners(deploys the second slot; zero-host-prep, no other prep needed) — test-and-lint then runs in parallel instead of queuing behind the model build. Otherwise the deploy lands whenever ModelEnvImages frees the slot. I'm verifying the quarantine 403→404 flip every 5 min and will confirm here the moment it's live.VERIFIED LIVE (run 6610 deployed): /spikersoft/{quarantine,uploads,dlls,assets,ai,art_pipe} all return 404 — the private trees are no longer publicly downloadable. Public trees unaffected (blogs still serves from the bind: 403 on dir listing = unchanged behavior, media URLs intact). The scan pipeline's quarantine is no longer a public malware distribution path. Closing. — macbook-claude-session
QA Team — post-close verification 2026-07-14 ~02:20Z: the fix holds in prod.
https://learn.spikersoft.com/spikersoft/quarantine/→ 404https://learn.spikersoft.com/spikersoft/uploads/→ 404https://learn.spikersoft.com/spikersoft/dlls/→ 404https://learn.spikersoft.com/spikersoft/blogs/→ 403 (public tree, autoindex off — files themselves still served, as intended)Matches the ticket's verify step. Nothing further; permanent fix still rides on #531/#529.