mirror of
https://github.com/storytold/figcraft.git
synced 2026-10-30 05:16:56 -06:00
Christopher Linnett
f1c2ee81e4
Image entries applied bytes to any key with no checks (audit COL-9): a collaborator could poison the shared content-addressed image store, claim absurd dimensions, balloon memory, or name an image `../../x`, which a saved file then wrote as the archive member `images/../../x`. - Every key must be 1–128 ASCII letters, digits, `-` or `_`: `figcraft_doc::ImageData::is_valid_key`, promoted from the format crate's private `is_valid_hash` so the file reader and collab share one rule. The reader now also takes `-` and `_`, so the REST importer's `rest-image-missing` placeholder survives a save and load. - The REST importer's side of the same attack: an unresolved `imageRef` that can't legitimately be an archive member name (path text, an over-long ref) shares the `rest-image-missing` placeholder instead of being keyed by its raw name (`image_tests::a_path_like_rest_image_ref_never_names_an_archive_member`). - A key with the shape of a content hash (64 hex chars) must be exactly the lowercase sha256 of the bytes, the form `image_hash` writes; an uppercase look-alike is refused. Other keys (svg FNV-128, REST placeholders) claim no content address and only meet the rules above. - A side is at most 65 535 px; decoded bytes at most 32 MiB, with the base64 text capped before decoding. 0×0 stays valid: the format crate stores it for sizes it can't probe. - Refusals are Error::Invalid and reject their batch, so every replica's store stays clean; catch-up snapshots apply through the same check. - Docs: collab-protocol.md, collaboration-parity.md and file-format-parity.md (rows, status lines, histories). - Tests: collab image_tests (8), format image_tests: round-trip and the REST placeholder gate.
25 lines
791 B
TOML
25 lines
791 B
TOML
[package]
|
|
name = "figcraft-collab"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
license.workspace = true
|
|
description = "FigCraft real-time collaboration core: the synced object/property model, change sets, fractional positions, server ordering and validation, client reconciliation, per-user undo, offline queueing and reconnect, and the wire messages (no networking)"
|
|
|
|
[lints]
|
|
workspace = true
|
|
|
|
[dependencies]
|
|
figcraft-doc = { workspace = true }
|
|
serde = { workspace = true }
|
|
serde_json = { workspace = true }
|
|
thiserror = { workspace = true }
|
|
chrono = { workspace = true }
|
|
imbl = { workspace = true }
|
|
base64 = { workspace = true }
|
|
postcard = { workspace = true }
|
|
sha2 = { workspace = true }
|
|
|
|
[dev-dependencies]
|
|
figcraft-color = { workspace = true }
|
|
figcraft-geom = { workspace = true }
|