fix: harden network security boundaries #213

Open

TapTap wants to merge 5 commits from security-fixes into dev

pull from: security-fixes

merge into: TapTap:dev

TapTap:dev

TapTap:refactor/codebase-structure

TapTap:docs/rsync-compatible-readme

TapTap:main

Conversation 0 Commits 5 Files Changed 16

+413 -60

TapTap commented 2026-08-15 12:36:05 +02:00

Owner

Copy Link

Copy Source

Summary

• require explicit opt-in for plaintext or anonymous network clients
• require CA verification and harden TLS key and cipher handling
• bound remote configuration, delta, chunk, and incremental allocations
• reject embedded NUL paths and harden batch path lookups against symlinks

Verification

• cmake --build build -j2
• ./build/tests
• python3 -m pytest tests/ -q (39 passed, 10 skipped, 1 xpassed)

## Summary - require explicit opt-in for plaintext or anonymous network clients - require CA verification and harden TLS key and cipher handling - bound remote configuration, delta, chunk, and incremental allocations - reject embedded NUL paths and harden batch path lookups against symlinks ## Verification - cmake --build build -j2 - ./build/tests - python3 -m pytest tests/ -q (39 passed, 10 skipped, 1 xpassed)

TapTap added 1 commit 2026-08-15 12:36:06 +02:00

fix: harden network security boundaries ff189aeef2

TapTap added 1 commit 2026-08-15 12:49:35 +02:00

fix: validate remaining wire booleans 6f8847899c

TapTap added 1 commit 2026-08-15 13:14:01 +02:00

fix: address delegated review findings 298bfe0d0f

TapTap added 1 commit 2026-08-15 13:24:19 +02:00

fix: address remaining PR review findings daf662cc2d

TapTap added 1 commit 2026-08-15 13:44:35 +02:00

fix: harden remaining review findings 78876b110e

Some checks are pending

Hide all checks

CI / lint (pull_request) Successful in 34s

Details

CI / sanitizers (address) (pull_request) Successful in 37s

Details

CI / sanitizers (undefined) (pull_request) Successful in 37s

Details

CI / fuzz-build (pull_request) Successful in 15s

Details

CI / coverage (pull_request) Successful in 33s

Details

CI / build-and-test (pull_request) Successful in 1m16s

Details

CI / valgrind (pull_request) Successful in 33s

Details

This pull request has changes conflicting with the target branch.

• README.md

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin security-fixes:security-fixes

git checkout security-fixes

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

bug

Defect or bug

enhancement

Feature or improvement

memory

Memory safety issue

needs-triage

Needs human review

performance

Performance issue

quality

Code quality improvement

security

Security vulnerability

threading

Threading or concurrency

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

TapTap

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: TapTap/FastSync#213