cesnimda
626a9f8454
Backend security fixes from the Phase 1 register / Phase 2 roadmap (PR1 + V-01): - V-01 SSRF: new SafeHttpGuard validates outbound unsubscribe URLs (scheme allowlist + DNS-resolve-and-block private/loopback/link-local/ULA/metadata ranges), wired into UnsubscribeService; the "unsubscribe" HttpClient now disables auto-redirect so a validated external URL can't 3xx into an internal target. +33 unit tests. - V-04: session cookie SecurePolicy=Always in non-dev (SameAsRequest in dev). - V-06: UseExceptionHandler/ProblemDetails in prod; Cleanup/Unsubscribe no longer echo ex.Message to clients (logged server-side, generic message returned). - V-08: ForwardedHeaders trusted only from configurable KnownNetworks (default private ranges) + ForwardLimit, instead of trusting any client. New ForwardedHeaders config. - V-09: returnUrl validated with Url.IsLocalUrl (no open redirect via OAuth flow). - V-10: SearchService clamps Page/PageSize (<=200); Analytics clamps take/days. - V-11: baseline security headers (nosniff, X-Frame-Options DENY, Referrer-Policy, COOP) + HSTS in prod. - V-13: /app/info discloses only devMode to anonymous callers unless dev mode is on. - V-12: API container runs as non-root 'app' user (keys dir pre-owned). - V-03: Postgres + API ports bound to 127.0.0.1; POSTGRES_PASSWORD now required (no weak default fallback). API compatibility preserved (clamps not rejections; error-body shape changes only on failure paths). No DB migrations. Build + all 33 unit tests green. V-15 (MailKit NU1902) persists across versions and the SMTP path is default-off — tracked, not bumped. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
46 lines
1.5 KiB
C#
46 lines
1.5 KiB
C#
using Asp.Versioning;
|
|
using Microsoft.AspNetCore.Authorization;
|
|
using Microsoft.AspNetCore.Mvc;
|
|
|
|
namespace InboxIntel.Api.Controllers;
|
|
|
|
/// <summary>
|
|
/// Public metadata the SPA reads on load to decide whether to show the dev
|
|
/// banner. devMode falls back to the hosting environment when App:DevMode is
|
|
/// unset, and can be forced on/off via the App:DevMode config / App__DevMode env.
|
|
/// </summary>
|
|
[ApiController]
|
|
[ApiVersion("1.0")]
|
|
[Route("api/v{version:apiVersion}/app")]
|
|
public class AppInfoController : ControllerBase
|
|
{
|
|
private readonly IConfiguration _config;
|
|
private readonly IWebHostEnvironment _env;
|
|
|
|
public AppInfoController(IConfiguration config, IWebHostEnvironment env)
|
|
{
|
|
_config = config;
|
|
_env = env;
|
|
}
|
|
|
|
[HttpGet("info")]
|
|
[AllowAnonymous]
|
|
public IActionResult Info()
|
|
{
|
|
var devMode = _config.GetValue<bool?>("App:DevMode") ?? _env.IsDevelopment();
|
|
// V-13: when NOT in dev mode, disclose nothing beyond the flag to anonymous
|
|
// callers. The dev banner (the only consumer of environment/maxMessages) only
|
|
// renders when devMode is true, so this preserves the feature without leaking
|
|
// the environment name or sync cap in production.
|
|
if (!devMode)
|
|
return Ok(new { devMode = false });
|
|
|
|
return Ok(new
|
|
{
|
|
devMode = true,
|
|
environment = _env.EnvironmentName,
|
|
maxMessages = _config.GetValue<int>("GmailSync:MaxMessages")
|
|
});
|
|
}
|
|
}
|