Security review

Internal review of the Moss code base, written by the people building it. It is not a substitute for an external audit. It records what was looked at, what was found, what was fixed (with the test that pins the fix) and what was accepted and why. Read it together with the threat model.

Scope: the Rust controller (src/), the embedded UI’s interaction with it, the container backend, the CurseForge edge function boundary and the CI definitions. Method: reading the code against the gaps listed in the threat model, grepping for risky patterns (dynamic SQL, unwrap/expect/indexing on request data, file creation modes, header construction, logging of secrets), and exercising the fixes with tests against the real binary. Not done: fuzzing, dynamic analysis, review of third-party crates beyond the automated advisory scan (see CI audit), review of the Supabase project configuration, and anything that needs a real Docker or Podman (none was available).

Findings

Dependency advisories accepted

• RUSTSEC-2023-0071 (rsa Marvin timing attack). Reached only through jsonwebtoken. Moss verifies tokens with public keys and never signs or decrypts with an RSA private key, which is the affected operation. No fixed release exists. Listed in .cargo/audit.toml and deny.toml.
• RUSTSEC-2024-0449 (unsafe-libyaml unmaintained, via serde_yaml_ng). No known vulnerability; parses administrator-edited files capped at 1 MiB. Revisit when a maintained YAML parser is a drop-in.

npm audit --omit=dev --audit-level=high reports 0 vulnerabilities for the production dependencies (the UI is built into static files, so development-only packages never ship). The checks run weekly and on lockfile changes in .github/workflows/audit.yml; deny.toml also enforces the licence allow-list and bans unknown registries and git sources.

Reviewed and found sound

• SQL. All values are bound parameters. The only formatted SQL is column lists and fixed table names from constants (COLS, SEL, migrations tests); no request data reaches a SQL string.
• Header injection. Download file names are either generated from validated ids or reduced to printable ASCII without quotes; no request header values are echoed.
• Error messages. ApiError from an internal failure returns internal error and logs the detail server-side; I/O NotFound/PermissionDenied map to generic messages. Import and webhook messages name hosts and paths the caller supplied, not controller internals.
• Panics on request data. All non-test unwrap/expect/indexing sites were checked: the remaining ones operate on constants, database values written by Moss, values validated earlier in the same handler (for example sched::create after validate), or Regex::new on literals.
• Modpack archives (content/modpack/zipsafe.rs): per-entry and total size caps, entry cap, header size enforced while reading, safe_join for every target, symlinks and .moss refused.
• Blueprints: imported JSON is reduced to known fields; property names and values are restricted, secret-looking and network-binding keys are dropped; a blueprint cannot name a path.
• Config editors: the editable files are a fixed catalogue; world folder names cannot start with . or contain separators; writes go through safe_join, undo snapshots and a 1 MiB limit; secret fields are never returned.
• Auth throttling: failed credentials per client address, ticket cap, setup claim limiter; the limiter map is swept.
• Secrets files: backup-secrets.json and setup-token are created 0600 with create_new; support-bundle redaction covers webhooks, JWTs, API tokens, bearer headers, key/value secrets, emails and long hex or base64 runs.
• Webhook and S3 outbound: HTTPS only, destination resolved once and pinned, no redirects, private ranges refused unless explicitly allowed.

Accepted risks

• Same-user game servers can read everything Moss can (database, other servers, secrets) unless container isolation is used; containers share the kernel and the server directory is writable by the game. See the threat model.
• Check-then-use races in safe_join against a process that can create symlinks inside the server directory (the game server itself). Closing it needs openat2/O_NOFOLLOW descriptor-relative handling throughout; not done.
• CSP connect-src still lists ws: and wss: for any host because older WebKit versions do not apply 'self' to WebSocket URLs. A script injection (none known) could exfiltrate over a WebSocket. Tightening it is planned once those browsers are out of support.
• style-src 'unsafe-inline' remains for the UI framework’s inline styles.
• Webhook resolution oracle. The error text for a refused target names the non-public address it resolved to; only administrators can configure webhooks.
• YAML parsing of an edited config file (1 MiB cap) uses a general parser; pathological alias expansion is bounded by the library’s own limits, not by Moss.
• Folder import reads small metadata files (server.properties, velocity.toml) without a size cap; the path is administrator-supplied and symlinks are not copied.
• Container game-only network relies on Docker’s behaviour with IP masquerading off. It was verified against a command-recording stub only; the host and other containers on the same bridge stay reachable from the server. Documented in the architecture notes.
• No per-user request rate limit and no concurrency limit: rely on the reverse proxy.
• Staging port range, ticket cap and outstanding operations are bounded counts, not quotas per user.

Reporting

See SECURITY.md.