cdricms/vnidrop
1
1
Fork 0
mirror of https://github.com/sudosylabs/vnidrop.git synced 2026-08-05 02:29:55 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): address medium findings for ACL, limits, and UX

Browse Source 
Tighten approve-endpoint to active shares with TTL sessions, reject non-file
FDs, lower default ticket/approval/size caps, show endpoint IDs and Public-mode
warnings, harden Android receive path checks, and run cargo-audit in CI.
This commit is contained in:
Hammed Abass
2026-07-13 18:54:28 +02:00
parent e7fb0331b5
commit d0c8d8774a
18 changed files with 184 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
.cargo/audit.toml Normal file
View File

@@ -0,0 +1,11 @@
# Known transitive advisories we cannot fully clear without upstream iroh bumps.
# cargo audit in CI fails on new unlisted vulnerabilities.
[advisories]
ignore = [
# rsa: Marvin timing side-channel; no fixed release; pulled by iroh stack.
"RUSTSEC-2023-0071",
# quick-xml / crossbeam-epoch: transitive; track via iroh/dependency updates.
"RUSTSEC-2026-0194",
"RUSTSEC-2026-0195",
"RUSTSEC-2026-0204",
]