senke/veza
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
veza/veza-stream-server
History
senke 2d664f9177 fix(security): add SSRF protection, real track access validation, and pagination bounds 
- Add IsURLSafe() function to webhook service blocking private IPs,
  localhost, and cloud metadata endpoints (SSRF protection)
- Implement real validate_track_access() in stream server querying DB
  for track visibility, ownership, and purchase status
- Remove dangerous JWT fallback user in chat server that allowed
  deleted users to maintain access with forged credentials
- Add upper limit (100) on pagination in profile, track, and room handlers
- Fix Dockerfile.production healthcheck path to /api/v1/health

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-12 22:44:03 +01:00
..
.github/workflows fix(ci): upgrade deprecated actions, fix Go version 2026-02-11 23:14:50 +01:00
audio adding initial stream server (Rust) 2025-12-03 20:36:56 +01:00
benches adding initial stream server (Rust) 2025-12-03 20:36:56 +01:00
dashboards adding initial stream server (Rust) 2025-12-03 20:36:56 +01:00
docs P0: stabilisation backend/chat/stream + nouvelle base migrations v1 2025-12-06 11:14:38 +01:00
k8s/production adding initial stream server (Rust) 2025-12-03 20:36:56 +01:00
migrations report generation and future tasks selection 2025-12-08 19:57:54 +01:00
proto adding initial stream server (Rust) 2025-12-03 20:36:56 +01:00
scripts report generation and future tasks selection 2025-12-08 19:57:54 +01:00
src fix(security): add SSRF protection, real track access validation, and pagination bounds 2026-02-12 22:44:03 +01:00
tools adding initial stream server (Rust) 2025-12-03 20:36:56 +01:00
.clippy.toml adding initial stream server (Rust) 2025-12-03 20:36:56 +01:00
.env.example fix(security): validate OAuth redirect URL against allowlist, require auth for internal transcode endpoint 2026-02-11 21:28:26 +01:00
.gitignore report generation and future tasks selection 2025-12-08 19:57:54 +01:00
AUDIT_EXHAUSTIF_STREAM_SERVER.md refonte: backend-api go first; phase 1 2025-12-12 21:34:34 -05:00
AUDIT_STREAM_SERVER_RUST.md adding initial stream server (Rust) 2025-12-03 20:36:56 +01:00
build.rs [T0-002] fix(rust): Corriger erreurs compilation Rust 2026-01-04 01:44:20 +01:00
Cargo.toml fix(deps): upgrade outdated Rust dependencies across services 2026-02-11 23:18:34 +01:00
check_errors.txt report generation and future tasks selection 2025-12-08 19:57:54 +01:00
docker-compose.yml fix(security): restrict CORS origins in stream-server 2026-02-11 22:42:04 +01:00
Dockerfile fix(stream): migrate sqlx query! macros to runtime queries 2026-02-11 22:49:30 +01:00
Dockerfile.production adding initial stream server (Rust) 2025-12-03 20:36:56 +01:00
env.example adding initial stream server (Rust) 2025-12-03 20:36:56 +01:00
install.sh adding initial stream server (Rust) 2025-12-03 20:36:56 +01:00
Makefile adding initial stream server (Rust) 2025-12-03 20:36:56 +01:00
RAPPORT_LAB.md report generation and future tasks selection 2025-12-08 19:57:54 +01:00
sync_errors.txt report generation and future tasks selection 2025-12-08 19:57:54 +01:00
sync_test_error.txt report generation and future tasks selection 2025-12-08 19:57:54 +01:00
test_output.txt report generation and future tasks selection 2025-12-08 19:57:54 +01:00