Joseph Spiker spikerj
  • Joined on 2025-11-03
spikerj closed issue spikerj/spikersoft-issues#410 2026-07-06 15:28:59 +00:00
[Reliability][Go-live] Fix silent data loss — count-only ValueComparer & missing publisher confirms
spikerj commented on issue spikerj/spikersoft-issues#438 2026-07-06 15:28:54 +00:00
[Security][Decision] SSRF: HttpCallback scheduled task fetches an unrestricted payload-supplied URL (admin/staff-gated)

Egress guard merged — PR #137 (529b462). The HttpCallback SSRF pivot is closed: deny-internal-by-default SsrfEgressPolicy enforced at connect time (blocks private/loopback/link-local/metad…

spikerj commented on issue spikerj/spikersoft-issues#410 2026-07-06 15:28:49 +00:00
[Reliability][Go-live] Fix silent data loss — count-only ValueComparer & missing publisher confirms

Both halves complete — closing.

Final publishers merged to master:

  • PR #135 (376272c) — ScheduledTask + ClusterEvent publishers (+ self-healing channel fix)
  • PR #136 (de8be87)…
spikerj commented on issue spikerj/spikersoft-issues#438 2026-07-06 15:23:59 +00:00
[Security][Decision] SSRF: HttpCallback scheduled task fetches an unrestricted payload-supplied URL (admin/staff-gated)

PR #137 up — implements the recommended egress guard as a secure-by-default, with the PR as the decision point (same pattern as the CORS fail-closed change).

  • SsrfEgressPolicy in…
spikerj commented on issue spikerj/spikersoft-issues#410 2026-07-06 15:16:40 +00:00
[Reliability][Go-live] Fix silent data loss — count-only ValueComparer & missing publisher confirms

Final publisher shipped: PR #136 (GameEventPublisher) — and the a/b/c latency question I'd held it for turned out to be moot: every RabbitMQ publish in that class is persistence-bound…

spikerj commented on issue spikerj/spikersoft-issues#410 2026-07-06 15:07:45 +00:00
[Reliability][Go-live] Fix silent data loss — count-only ValueComparer & missing publisher confirms

Publisher-confirms progress:

  • PR #132 (canonical RabbitMqMessageBusPublisher) — merged 784ae28
  • PR #133 (NotificationEventPublisher + RabbitMqSystemEventPublisher) — merged…
spikerj commented on issue spikerj/spikersoft-issues#410 2026-07-06 14:51:00 +00:00
[Reliability][Go-live] Fix silent data loss — count-only ValueComparer & missing publisher confirms

Batch 2 up: PR #133NotificationEventPublisher + RabbitMqSystemEventPublisher now create their channel with confirms + tracking (2 tests).

Remaining publisher paths: `RabbitMqClusterEve…

spikerj commented on issue spikerj/spikersoft-issues#410 2026-07-06 14:41:12 +00:00
[Reliability][Go-live] Fix silent data loss — count-only ValueComparer & missing publisher confirms

Publisher-confirms — first path shipped: PR #132 (canonical RabbitMqMessageBusPublisher). Channel now created with confirms + tracking; BasicPublishAsync awaits the broker ack and an…

spikerj closed issue spikerj/spikersoft-issues#441 2026-07-06 14:32:37 +00:00
[Security][low] Bearer confirmation token logged in plaintext (OrganizationsController:118) — only such site
spikerj commented on issue spikerj/spikersoft-issues#441 2026-07-06 14:32:18 +00:00
[Security][low] Bearer confirmation token logged in plaintext (OrganizationsController:118) — only such site

Resolved in spikersoft-backend PR #131 (merged to master as 67a7ac9). The raw confirmation token is no longer written to the log; regression test asserts the token value never reaches the log…

spikerj commented on issue spikerj/spikersoft-issues#401 2026-07-06 14:13:54 +00:00
[Security][CRITICAL] SignalR hubs missing class-level [Authorize] — CodeExecutionHub / DashboardHub / ClusterHub open to anonymous connections

GameBoardHub gated — PR #128 merged (402be55). All six hubs from the audit are now addressed: CodeExecutionHub / ChatHub / DashboardHub / ClusterHub / GameBoardHub carry class-level…

spikerj commented on issue spikerj/spikersoft-issues#410 2026-07-06 14:13:48 +00:00
[Reliability][Go-live] Fix silent data loss — count-only ValueComparer & missing publisher confirms

Mode-#2 (deep-clone snapshot) is complete — final two batches merged to master:

  • PR #124 (f4adad0) — FundraiserItem / SolicitationZone / AreaRecommendation / Chapter.
  • PR #125…
spikerj closed issue spikerj/spikersoft-issues#440 2026-07-06 14:13:35 +00:00
[Security][Go-live] Pre-registration email verification codes generated with System.Random (predictable)
spikerj closed issue spikerj/spikersoft-issues#439 2026-07-06 14:13:34 +00:00
[Security][Go-live] CORS fails OPEN when Origins unconfigured — reflects any origin with credentials
spikerj closed issue spikerj/spikersoft-issues#437 2026-07-06 14:13:33 +00:00
[Security][Hardening] Contain path traversal: identity/upload-derived path segments in blog-media move
spikerj closed issue spikerj/spikersoft-issues#436 2026-07-06 14:13:31 +00:00
[Security][Go-live] Unescaped user input used as Mongo regex → ReDoS / regex-injection (incl. anonymous lesson search)
spikerj commented on issue spikerj/spikersoft-issues#440 2026-07-06 14:13:13 +00:00
[Security][Go-live] Pre-registration email verification codes generated with System.Random (predictable)

Resolved in spikersoft-backend PR #130 (merged to master as 389f570). Pre-registration verification codes now use SecureNumericCode (CSPRNG via RandomNumberGenerator) in both Initiate +…

spikerj commented on issue spikerj/spikersoft-issues#439 2026-07-06 14:13:11 +00:00
[Security][Go-live] CORS fails OPEN when Origins unconfigured — reflects any origin with credentials

Resolved in spikersoft-backend PR #129 (merged to master as e4ed404). CORS now fails closed when Origins is unconfigured (refuses cross-origin + logs CRITICAL) instead of reflecting any…

spikerj commented on issue spikerj/spikersoft-issues#437 2026-07-06 14:12:59 +00:00
[Security][Hardening] Contain path traversal: identity/upload-derived path segments in blog-media move

Resolved in spikersoft-backend PR #127 (merged to master as 7364964). PathSafety.CombineContained now contains the blog-media move to /app/blogs (rejects ../ traversal + absolute-path…

spikerj commented on issue spikerj/spikersoft-issues#436 2026-07-06 14:12:57 +00:00
[Security][Go-live] Unescaped user input used as Mongo regex → ReDoS / regex-injection (incl. anonymous lesson search)

Resolved in spikersoft-backend PR #126 (merged to master as b5bb73d). MongoRegexSearch.LiteralContains now Regex.Escapes user search input at all 5 sites (GetAllLessons + UserSubmittedCode)…