iamdoubz
5c46bd0e85
The 08 §1 threat table checked line by line against the code, plus a review by a separate agent that hadn't written it. Findings were reproduced with a failing test before each fix: - Critical: "011…,4" turned the route's Goto into Goto(sp-route-…,011…,4,1), starting past the class check, so any extension could call abroad. FILTER on the dialed number (also stops "&" adding a Dial target). trunk-test.ts proves it. - High: -web endpoints (desk phone's password, any transport) skipped the phone ACL; now 127.0.0.1 only when it's on. call-test.ts: UDP refused, WebSocket from 127.0.0.1 registers. - IVR direct dial no longer reaches paging groups or parked calls (sp-ivr-direct). - Trunks identify_by = ip: a From of trunk-<id> from anywhere no longer rings phones. - .dockerignore is an allowlist, so the public source archive can't pick up stray files. - CSRF check on the matched route (/%61pi/… got around it); Linphone tokens masked in logs; /api/live checks Origin and re-checks the session; *45/** filter digits; pg_dump password in the environment; more webhook ranges blocked. The review and what's left for the owner are in 08 §6. Task: M11-T8
41 lines
769 B
Plaintext
41 lines
769 B
Plaintext
# Also what selfphone.tar.gz (the source archive in the api image, 08 §4) holds, and anyone can
|
|
# download that (GET /api/about/source): an allowlist (M11-T8), so a backup, key or override file
|
|
# dropped into the repo folder never ends up in it. Add new top-level source here.
|
|
*
|
|
!.dockerignore
|
|
!.env.example
|
|
!.gitattributes
|
|
!.github
|
|
!.gitignore
|
|
!.prettierignore
|
|
!.prettierrc.json
|
|
!AGENTS.md
|
|
!CLAUDE.md
|
|
!LICENSE
|
|
!README.md
|
|
!apps
|
|
!asterisk
|
|
!deploy
|
|
!docker-compose.yml
|
|
!docs
|
|
!eslint.config.js
|
|
!package.json
|
|
!packages
|
|
!pnpm-lock.yaml
|
|
!pnpm-workspace.yaml
|
|
!scripts
|
|
!tsconfig.base.json
|
|
!vitest.config.ts
|
|
# ...and inside those, nothing built or private.
|
|
**/node_modules
|
|
**/dist
|
|
**/coverage
|
|
**/*.tsbuildinfo
|
|
**/.env
|
|
**/.env.*
|
|
!.env.example
|
|
**/*.pem
|
|
**/*.key
|
|
**/*.log
|
|
**/*.pid
|