s1d3sw1ped/scratchbox
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 5 Wiki Activity

Harden HTTP defaults and proxy header trust.

Browse Source 
Add explicit server timeout/header limits, require trusted proxy CIDRs when honoring forwarded IP headers, and document single-instance storage expectations.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Justin Harms
2026-05-31 21:09:00 -05:00
parent dbf112a5b7
commit dbb72da312
7 changed files with 246 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/config/config.go
+74 -6
View File
@@ -15,6 +15,11 @@ import (
const (
defaultListenAddr = ":8080"
defaultReadHeaderTimeout = "5s"
defaultReadTimeout = "30s"
defaultWriteTimeout = "30s"
defaultIdleTimeout = "120s"
defaultMaxHeaderBytes = 1 << 20
defaultMaxUploadSize = "100MiB"
defaultTTL = "1h"
defaultRawCacheMaxSize = "200MiB"
@@ -36,7 +41,16 @@ type Config struct {
}
type ServerConfig struct {
ListenAddr string `yaml:"listen_addr" comment:"Address to bind the HTTP server to."`
ListenAddr string `yaml:"listen_addr" comment:"Address to bind the HTTP server to."`
ReadHeaderTimeout string `yaml:"read_header_timeout" comment:"Maximum duration for reading request headers (for slowloris protection). Must be > 0."`
ReadTimeout string `yaml:"read_timeout" comment:"Maximum duration for reading the full request, including body. Must be > 0."`
WriteTimeout string `yaml:"write_timeout" comment:"Maximum duration before timing out writes of a response. Must be > 0."`
IdleTimeout string `yaml:"idle_timeout" comment:"Maximum amount of time to wait for the next request when keep-alives are enabled. Must be > 0."`
MaxHeaderBytes int `yaml:"max_header_bytes" comment:"Maximum size of request headers in bytes. Must be > 0."`
ReadHeaderTimeoutDur time.Duration `yaml:"-"`
ReadTimeoutDur time.Duration `yaml:"-"`
WriteTimeoutDur time.Duration `yaml:"-"`
IdleTimeoutDur time.Duration `yaml:"-"`
}
type LimitsConfig struct {
@@ -56,10 +70,12 @@ type StorageConfig struct {
}
type SecurityConfig struct {
AllowedIPs []string `yaml:"allowed_ips" comment:"Allowlist for POST /api/scratch as IPs or CIDRs (examples: 127.0.0.1, 192.168.1.0/24). Keep 127.0.0.1 for local access; add trusted ranges as needed. Empty means unrestricted."`
TrustProxyHeaders bool `yaml:"trust_proxy_headers" comment:"Honor X-Forwarded-For / X-Real-IP when true (trusted proxy only)."`
RateLimit RateLimitConfig `yaml:"rate_limit" comment:"Per-client token bucket on POST /api/scratch."`
AllowedPrefixes []netip.Prefix `yaml:"-"`
AllowedIPs []string `yaml:"allowed_ips" comment:"Allowlist for POST /api/scratch as IPs or CIDRs (examples: 127.0.0.1, 192.168.1.0/24). Keep 127.0.0.1 for local access; add trusted ranges as needed. Empty means unrestricted."`
TrustProxyHeaders bool `yaml:"trust_proxy_headers" comment:"Honor X-Forwarded-For / X-Real-IP only when request source IP matches security.trusted_proxy_ips."`
TrustedProxyIPs []string `yaml:"trusted_proxy_ips" comment:"IPs/CIDRs of reverse proxies allowed to supply forwarded client IP headers. Required when trust_proxy_headers is true."`
RateLimit RateLimitConfig `yaml:"rate_limit" comment:"Per-client token bucket on POST /api/scratch."`
AllowedPrefixes []netip.Prefix `yaml:"-"`
TrustedProxyPrefixes []netip.Prefix `yaml:"-"`
}
type RateLimitConfig struct {
@@ -93,7 +109,12 @@ func Default() Config {
func defaults() Config {
return Config{
Server: ServerConfig{
ListenAddr: defaultListenAddr,
ListenAddr: defaultListenAddr,
ReadHeaderTimeout: defaultReadHeaderTimeout,
ReadTimeout: defaultReadTimeout,
WriteTimeout: defaultWriteTimeout,
IdleTimeout: defaultIdleTimeout,
MaxHeaderBytes: defaultMaxHeaderBytes,
},
Limits: LimitsConfig{
MaxUploadSize: defaultMaxUploadSize,
@@ -122,6 +143,45 @@ func (c *Config) Validate() error {
if strings.TrimSpace(c.Server.ListenAddr) == "" {
return errors.New("server.listen_addr is required")
}
readHeaderTimeout, err := time.ParseDuration(strings.TrimSpace(c.Server.ReadHeaderTimeout))
if err != nil {
return fmt.Errorf("server.read_header_timeout invalid: %w", err)
}
if readHeaderTimeout <= 0 {
return errors.New("server.read_header_timeout must be > 0")
}
c.Server.ReadHeaderTimeoutDur = readHeaderTimeout
readTimeout, err := time.ParseDuration(strings.TrimSpace(c.Server.ReadTimeout))
if err != nil {
return fmt.Errorf("server.read_timeout invalid: %w", err)
}
if readTimeout <= 0 {
return errors.New("server.read_timeout must be > 0")
}
c.Server.ReadTimeoutDur = readTimeout
writeTimeout, err := time.ParseDuration(strings.TrimSpace(c.Server.WriteTimeout))
if err != nil {
return fmt.Errorf("server.write_timeout invalid: %w", err)
}
if writeTimeout <= 0 {
return errors.New("server.write_timeout must be > 0")
}
c.Server.WriteTimeoutDur = writeTimeout
idleTimeout, err := time.ParseDuration(strings.TrimSpace(c.Server.IdleTimeout))
if err != nil {
return fmt.Errorf("server.idle_timeout invalid: %w", err)
}
if idleTimeout <= 0 {
return errors.New("server.idle_timeout must be > 0")
}
c.Server.IdleTimeoutDur = idleTimeout
if c.Server.MaxHeaderBytes <= 0 {
return errors.New("server.max_header_bytes must be > 0")
}
sizeBytes, err := parseHumanSize(c.Limits.MaxUploadSize)
if err != nil {
@@ -168,6 +228,14 @@ func (c *Config) Validate() error {
return fmt.Errorf("security.allowed_ips invalid: %w", err)
}
c.Security.AllowedPrefixes = prefixes
trustedProxyPrefixes, err := parseAllowedPrefixes(c.Security.TrustedProxyIPs)
if err != nil {
return fmt.Errorf("security.trusted_proxy_ips invalid: %w", err)
}
c.Security.TrustedProxyPrefixes = trustedProxyPrefixes
if c.Security.TrustProxyHeaders && len(c.Security.TrustedProxyPrefixes) == 0 {
return errors.New("security.trusted_proxy_ips is required when security.trust_proxy_headers is true")
}
if c.Security.RateLimit.RequestsPerMinute <= 0 {
return errors.New("security.rate_limit.requests_per_minute must be > 0")
internal/config/config_test.go
+90
View File
@@ -22,6 +22,21 @@ func TestValidateAppliesDefaultsAndParsedFields(t *testing.T) {
if cfg.Limits.MaxUploadSizeBytes != 100*1024*1024 {
t.Fatalf("MaxUploadSizeBytes = %d, want %d", cfg.Limits.MaxUploadSizeBytes, int64(100*1024*1024))
}
if cfg.Server.ReadHeaderTimeoutDur != 5*time.Second {
t.Fatalf("ReadHeaderTimeoutDur = %s, want 5s", cfg.Server.ReadHeaderTimeoutDur)
}
if cfg.Server.ReadTimeoutDur != 30*time.Second {
t.Fatalf("ReadTimeoutDur = %s, want 30s", cfg.Server.ReadTimeoutDur)
}
if cfg.Server.WriteTimeoutDur != 30*time.Second {
t.Fatalf("WriteTimeoutDur = %s, want 30s", cfg.Server.WriteTimeoutDur)
}
if cfg.Server.IdleTimeoutDur != 120*time.Second {
t.Fatalf("IdleTimeoutDur = %s, want 120s", cfg.Server.IdleTimeoutDur)
}
if cfg.Server.MaxHeaderBytes != 1<<20 {
t.Fatalf("MaxHeaderBytes = %d, want %d", cfg.Server.MaxHeaderBytes, 1<<20)
}
if cfg.Limits.DefaultTTLDuration != time.Hour {
t.Fatalf("DefaultTTLDuration = %s, want 1h", cfg.Limits.DefaultTTLDuration)
}
@@ -51,6 +66,11 @@ func TestLoadParsesConfiguredFields(t *testing.T) {
content := `
server:
listen_addr: "127.0.0.1:9090"
read_header_timeout: "4s"
read_timeout: "25s"
write_timeout: "35s"
idle_timeout: "90s"
max_header_bytes: 2097152
limits:
max_upload_size: "2MiB"
default_ttl: "2h"
@@ -64,6 +84,8 @@ security:
- "127.0.0.1"
- "10.0.0.0/8"
trust_proxy_headers: true
trusted_proxy_ips:
- "10.0.0.0/8"
rate_limit:
enabled: true
requests_per_minute: 12
@@ -81,6 +103,21 @@ security:
if cfg.Server.ListenAddr != "127.0.0.1:9090" {
t.Fatalf("ListenAddr = %q, want %q", cfg.Server.ListenAddr, "127.0.0.1:9090")
}
if cfg.Server.ReadHeaderTimeoutDur != 4*time.Second {
t.Fatalf("ReadHeaderTimeoutDur = %s, want 4s", cfg.Server.ReadHeaderTimeoutDur)
}
if cfg.Server.ReadTimeoutDur != 25*time.Second {
t.Fatalf("ReadTimeoutDur = %s, want 25s", cfg.Server.ReadTimeoutDur)
}
if cfg.Server.WriteTimeoutDur != 35*time.Second {
t.Fatalf("WriteTimeoutDur = %s, want 35s", cfg.Server.WriteTimeoutDur)
}
if cfg.Server.IdleTimeoutDur != 90*time.Second {
t.Fatalf("IdleTimeoutDur = %s, want 90s", cfg.Server.IdleTimeoutDur)
}
if cfg.Server.MaxHeaderBytes != 2*1024*1024 {
t.Fatalf("MaxHeaderBytes = %d, want %d", cfg.Server.MaxHeaderBytes, 2*1024*1024)
}
if cfg.Limits.MaxUploadSizeBytes != 2*1024*1024 {
t.Fatalf("MaxUploadSizeBytes = %d, want %d", cfg.Limits.MaxUploadSizeBytes, int64(2*1024*1024))
}
@@ -105,6 +142,9 @@ security:
if len(cfg.Security.AllowedPrefixes) != 2 {
t.Fatalf("AllowedPrefixes len = %d, want 2", len(cfg.Security.AllowedPrefixes))
}
if len(cfg.Security.TrustedProxyPrefixes) != 1 {
t.Fatalf("TrustedProxyPrefixes len = %d, want 1", len(cfg.Security.TrustedProxyPrefixes))
}
}
func TestValidateRejectsInvalidValues(t *testing.T) {
@@ -129,6 +169,41 @@ func TestValidateRejectsInvalidValues(t *testing.T) {
},
wantErr: "limits.max_upload_size",
},
{
name: "invalid read header timeout",
mutate: func(cfg *Config) {
cfg.Server.ReadHeaderTimeout = "bogus"
},
wantErr: "server.read_header_timeout",
},
{
name: "invalid read timeout",
mutate: func(cfg *Config) {
cfg.Server.ReadTimeout = "bogus"
},
wantErr: "server.read_timeout",
},
{
name: "invalid write timeout",
mutate: func(cfg *Config) {
cfg.Server.WriteTimeout = "bogus"
},
wantErr: "server.write_timeout",
},
{
name: "invalid idle timeout",
mutate: func(cfg *Config) {
cfg.Server.IdleTimeout = "bogus"
},
wantErr: "server.idle_timeout",
},
{
name: "invalid max header bytes",
mutate: func(cfg *Config) {
cfg.Server.MaxHeaderBytes = 0
},
wantErr: "server.max_header_bytes",
},
{
name: "invalid ttl parse",
mutate: func(cfg *Config) {
@@ -164,6 +239,21 @@ func TestValidateRejectsInvalidValues(t *testing.T) {
},
wantErr: "security.allowed_ips",
},
{
name: "invalid trusted proxy entry",
mutate: func(cfg *Config) {
cfg.Security.TrustedProxyIPs = []string{"not-an-ip"}
},
wantErr: "security.trusted_proxy_ips",
},
{
name: "trust proxy headers requires trusted proxies",
mutate: func(cfg *Config) {
cfg.Security.TrustProxyHeaders = true
cfg.Security.TrustedProxyIPs = nil
},
wantErr: "security.trusted_proxy_ips is required",
},
{
name: "invalid rate limit burst",
mutate: func(cfg *Config) {