Files

T

pluto 4f2430d354 fix(security): Whitelist bypass vulnerability

- Fixed URL whitelist to use proper domain boundary matching
- Added WhitelistTest.kt with 6 test cases
- Added IMPROVEMENTS.md with code review notes

Security fix identified by Spirit 👻
Co-authored-by: Spirit <spirit@hobbs.farm>
Co-authored-by: Margaret <margaret@hobbs.farm>

2026-02-03 09:11:06 -06:00

1.2 KiB

Raw Blame History

Improvements & Code Review Notes

Security Fixes Applied

P0: Whitelist Bypass Vulnerability (FIXED)

Issue: Original whitelist check used url.contains(domain) which would allow bypass:

https://hobbs.farm.evil.com would match hobbs.farm ❌

Fix: Use proper domain boundary matching:

val host = Uri.parse(url).host?.lowercase() ?: return false
return whitelist.any { domain ->
    host == domain || host.endsWith(".$domain")
}

Recommended Future Improvements

P1: PIN Storage Security

Current: Plain text in DataStore
Recommended: SHA-256 hash with salt
Implementation: Use MessageDigest to hash before storing

P2: UX Enhancements

Add loading indicator (ProgressBar) during page loads
Add network error screen with retry button
Consider swipe-to-refresh in admin settings

P2: Code Quality

Add unit tests for whitelist logic (added: WhitelistTest.kt)
Add instrumented tests for WebView behavior
Consider Kotlin coroutines for async operations

Test Coverage

Component	Tests	Status
Whitelist matching	6	✅
Idle timer	TBD	⏳
Admin PIN	TBD	⏳
Boot receiver	TBD	⏳

Code review by Spirit 👻 Coordinated by Pluto 🪐

1.2 KiB Raw Blame History