mirror of
https://github.com/greenart7c3/Amber.git
synced 2026-10-29 22:37:34 +00:00
greenart7c3
411f1d2f18
Fixes the findings of a security audit of the desktop app. Relay side: unknown senders are rate-limited per (relay, pubkey) and answered once without publish retries, so a flood of forged events can no longer buy signed replies or evict the log history (approved apps are never throttled, and the limiter runs after signature verification). The incoming relay-message buffer is bounded, dropping the oldest message instead of growing until OOM. Pending requests dedup on (account, connection, id) instead of the client-chosen id alone, and nostrconnect imports use full UUIDs. The lock is re-checked before signing and again before publishing. Log/history writes are debounced and flushed on lock, eviction and shutdown. Connection secrets and socket secret hashes are compared in constant time. Key storage: passphrase setup now heals a crash between writing the wrapped key and deleting the unprotected copies via a startup cleanup; the keystore is written atomically; passphrases are UTF-8-encoded from the CharArray without an immutable String copy; keystore, password file and wrapped-key temp files are created owner-only before content lands. Desktop integration: the AppIndicator shim lives in a fresh owner-only temp directory instead of a predictable shared /tmp path; the nostrconnect:// forward socket is 0600 and peer-checked like the signer socket, with forwarded URIs coalesced and rate-limited; the connectivity probe goes through Tor when Tor is on. UI/UX: the connect card shows the relays it approves and warns on cleartext ws:// relays; copying the nsec warns like the seed-words copy does (new string translated into every shipped language); .lan, .home.arpa and .internal names are no longer treated as local relays. Packaging: the systemd unit quotes ExecStart/Environment values correctly and refuses unsafe paths; the AppImage script pins appimagetool to a released version with a verified SHA-256.