fix(dig-node): gate cache.listCached behind the local control token (#2108) - #196
Merged
Conversation
Salvage anchor for the loop lane; real change follows. Co-Authored-By: Claude <noreply@anthropic.com>
…ver HTTP (#2108) `cache.listCached` was reachable UNAUTHENTICATED over the loopback HTTP `rpc` surface, so any local process — including a cross-site page POSTing to the loopback node (DNS-rebinding / local-service attack) — could enumerate the operator's full cached-capsule inventory (storeId:rootHash, sizes, LRU order), deanonymizing what content the user has consumed. Extend the existing holder-revealing `cache.*` HTTP landing gate to ALSO require the master control token or a valid paired token for `cache.listCached`, exactly like `cache.fetchAndCache`/`cache.pushCapsule`. An unauthorized call is rejected UNAUTHORIZED (-32030) with no inventory in the body. The in-process FFI `cache.*` path is unaffected (never reaches this handler); anonymous public CONTENT reads stay open. WS parity (#2032 lesson for reads): `cache.*` is NOT routable over `/ws` — the `ws_dispatch` fall-through hits `WalletBackend::dispatch`, whose match has no `cache.*` arm — so the HTTP gate is the only reachable surface. Asserted by test. Co-Authored-By: Claude <noreply@anthropic.com>
…est (#2108) Co-Authored-By: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #2108 (super-repo DIG-Network/dig_ecosystem#2108).
Problem:
cache.listCachedis reachable unauthenticated over the HTTPrpcsurface, so any local process — including a cross-site page POSTing to the loopback node (DNS-rebinding / local-service attack) — can enumerate the operator's full cached-capsule inventory (storeId:rootHash, sizes, LRU order), deanonymizing what content the user has consumed.Fix: gate
cache.listCachedbehind the same local control-token authorization the other holder-revealingcache.*methods already require (server.rs:990). FFI/in-process callers are unaffected; anonymous public content reads stay open. WS-path parity checked (gated or provably unroutable).TDD: failing regression test first (unauthenticated
cache.listCachedmust be rejected with no list leaked; authorized token returns the list). Coherence sweep: SPEC.md (both crates) + README + SYSTEM.md local-RPC auth contract + docs.dig.net + DEVELOPMENT_LOG. Versionfix:patch0.100.0→0.100.1(modules/apps nightlies).Draft = loop salvage anchor; implementation in progress.
Generated by Claude Code