Fix Issue #172 and Security Advisory GHSA-rmxw-pq4x-3fvh

Author: patrickhener

assets/js/src/collab.js

@@ -293,6 +293,7 @@ function fmtHeaders(headers) {
 // ══ HTTP LOG ══
 function onHTTP(e) {
   ST.httpEvents.unshift(e);
+  if (ST.httpEvents.length > 1000) ST.httpEvents.length = 1000;
   ST.httpCnt++;
   updateBadge("http-badge", ST.httpCnt);
   updateCollabBadge();
@@ -483,6 +484,7 @@ export function clearHTTP() {
 // ══ DNS LOG ══
 function onDNS(e) {
   ST.dnsEvents.unshift(e);
+  if (ST.dnsEvents.length > 1000) ST.dnsEvents.length = 1000;
   ST.dnsCnt.total++;
   if (e.qtype === "A") ST.dnsCnt.A++;
   else if (e.qtype === "MX") ST.dnsCnt.MX++;
@@ -560,6 +562,7 @@ export function clearDNS() {
 function onSMB(e) {
   console.log(e);
   ST.smbEvents.unshift(e);
+  if (ST.smbEvents.length > 1000) ST.smbEvents.length = 1000;
   updateBadge("smb-badge", ST.smbEvents.length);
   updateCollabBadge();
   renderSMB();
@@ -693,6 +696,7 @@ export function clearSMB() {
 // ══ LDAP Log ══
 function onLDAP(e) {
   ST.ldapEvents.unshift(e);
+  if (ST.ldapEvents.length > 1000) ST.ldapEvents.length = 1000;
   updateBadge("ldap-badge", ST.ldapEvents.length);
   updateCollabBadge();
   renderLDAP();
@@ -871,6 +875,7 @@ export function clearLDAP() {
 // ══ SMTP ══
 function onSMTP(e) {
   ST.smtpEvents.unshift(e);
+  if (ST.smtpEvents.length > 1000) ST.smtpEvents.length = 1000;
   updateBadge("smtp-badge", ST.smtpEvents.length);
   updateCollabBadge();
   renderSMTP();
@@ -1116,7 +1121,7 @@ export function renderSMTP() {
   empty.style.display = vis.length ? "none" : "flex";
   inbox.querySelectorAll(".mail-card").forEach((c) => c.remove());
 
-  vis.forEach((e, i) => {
+  vis.slice(0, 500).forEach((e, i) => {
     inbox.appendChild(buildMailCard(e, i === 0 && !filter));
   });
 }

httpserver/mux_test.go

@@ -578,6 +578,74 @@ func TestBulkDownload_Success(t *testing.T) {
 	require.Equal(t, "application/zip", w.Header().Get("Content-Type"))
 }
 
+func TestBulkDownload_ACL_NoCredentials(t *testing.T) {
+	dir := t.TempDir()
+	protected := filepath.Join(dir, "protected")
+	require.NoError(t, os.Mkdir(protected, 0755))
+	require.NoError(t, os.WriteFile(filepath.Join(protected, "secret.txt"), []byte("secret"), 0644))
+
+	hash, err := bcrypt.GenerateFromPassword([]byte("pass"), bcrypt.MinCost)
+	require.NoError(t, err)
+	acl := fmt.Sprintf(`{"auth":"user:%s"}`, hash)
+	require.NoError(t, os.WriteFile(filepath.Join(protected, ".goshs"), []byte(acl), 0644))
+
+	fs, _ := newTestFileServer(t, dir)
+	r := httptest.NewRequest(http.MethodGet, "/?bulk&file=/protected/secret.txt", nil)
+	w := httptest.NewRecorder()
+	fs.bulkDownload(w, r)
+	require.Equal(t, http.StatusUnauthorized, w.Code)
+}
+
+func TestBulkDownload_ACL_WithCredentials(t *testing.T) {
+	dir := t.TempDir()
+	protected := filepath.Join(dir, "protected")
+	require.NoError(t, os.Mkdir(protected, 0755))
+	require.NoError(t, os.WriteFile(filepath.Join(protected, "secret.txt"), []byte("secret"), 0644))
+
+	hash, err := bcrypt.GenerateFromPassword([]byte("pass"), bcrypt.MinCost)
+	require.NoError(t, err)
+	acl := fmt.Sprintf(`{"auth":"user:%s"}`, hash)
+	require.NoError(t, os.WriteFile(filepath.Join(protected, ".goshs"), []byte(acl), 0644))
+
+	fs, _ := newTestFileServer(t, dir)
+	r := httptest.NewRequest(http.MethodGet, "/?bulk&file=/protected/secret.txt", nil)
+	r.Header.Set("Authorization", basicAuthHeader("user", "pass"))
+	w := httptest.NewRecorder()
+	fs.bulkDownload(w, r)
+	require.Equal(t, http.StatusOK, w.Code)
+	require.Equal(t, "application/zip", w.Header().Get("Content-Type"))
+}
+
+func TestBulkDownload_ACL_BlockList(t *testing.T) {
+	dir := t.TempDir()
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "blocked.txt"), []byte("nope"), 0644))
+	require.NoError(t, os.WriteFile(filepath.Join(dir, ".goshs"), []byte(`{"block":["blocked.txt"]}`), 0644))
+
+	fs, _ := newTestFileServer(t, dir)
+	r := httptest.NewRequest(http.MethodGet, "/?bulk&file=/blocked.txt", nil)
+	w := httptest.NewRecorder()
+	fs.bulkDownload(w, r)
+	require.Equal(t, http.StatusNotFound, w.Code)
+}
+
+func TestBulkDownload_ACL_InheritedFromParent(t *testing.T) {
+	dir := t.TempDir()
+	sub := filepath.Join(dir, "sub")
+	require.NoError(t, os.Mkdir(sub, 0755))
+	require.NoError(t, os.WriteFile(filepath.Join(sub, "file.txt"), []byte("data"), 0644))
+
+	hash, err := bcrypt.GenerateFromPassword([]byte("pass"), bcrypt.MinCost)
+	require.NoError(t, err)
+	acl := fmt.Sprintf(`{"auth":"user:%s"}`, hash)
+	require.NoError(t, os.WriteFile(filepath.Join(dir, ".goshs"), []byte(acl), 0644))
+
+	fs, _ := newTestFileServer(t, dir)
+	r := httptest.NewRequest(http.MethodGet, "/?bulk&file=/sub/file.txt", nil)
+	w := httptest.NewRecorder()
+	fs.bulkDownload(w, r)
+	require.Equal(t, http.StatusUnauthorized, w.Code)
+}
+
 // ─── returnJsonDirListing tests ──────────────────────────────────────────────
 
 func TestReturnJsonDirListing(t *testing.T) {

httpserver/updown.go

@@ -8,6 +8,7 @@ import (
 	"net/http"
 	"os"
 	"path/filepath"
+	"slices"
 	"strings"
 	"time"
 
@@ -229,12 +230,24 @@ func (fs *FileServer) bulkDownload(w http.ResponseWriter, req *http.Request) {
 		return
 	}
 
-	// Validate each path and collect absolute paths; skip any traversal attempts
+	// Validate each path, enforce .goshs ACL, and collect absolute paths.
+	// ACL checks must happen here, before any response headers are written,
+	// so that applyCustomAuth/handleError can still send a proper HTTP error.
 	for _, file := range files {
 		absPath, err := sanitizePath(fs.Webroot, file)
 		if err != nil {
 			continue
 		}
+		acl, aclErr := fs.findEffectiveACL(filepath.Dir(absPath))
+		if aclErr == nil {
+			if ok := fs.applyCustomAuth(w, req, acl); !ok {
+				return
+			}
+			if slices.Contains(acl.Block, filepath.Base(absPath)) {
+				fs.handleError(w, req, fmt.Errorf("requested file is blocked"), http.StatusNotFound)
+				return
+			}
+		}
 		filesCleaned = append(filesCleaned, absPath)
 	}