mirror of
https://github.com/ruvnet/RuView
synced 2026-08-05 19:41:44 +00:00
@aaronjmars
3685d16a49
The sensing-server binds to 127.0.0.1 by default with no `Host` header validation on either router. A foreign page can lower its DNS TTL, re-resolve to 127.0.0.1 after the browser has accepted the origin, and then read live pose + vital signs from /api/v1/* + /ws/sensing as same-origin against the attacker's hostname. When `RUVIEW_API_TOKEN` is unset (the documented LAN-mode default from #443/#547) the attacker can also drive state-mutating POSTs (recording/start, models/load, adaptive/train, calibration/start, sona/activate). Defense: a small `host_validation` axum middleware that pins the `Host` header to a configurable allowlist. The loopback names (`localhost`, `127.0.0.1`, `[::1]`, each with or without a port) are always in the set, so default 127.0.0.1 deployments keep working from the local browser without any configuration change. Operators who bind to a routable address extend the set with one or more `--allowed-host` flags or a comma-separated `SENSING_ALLOWED_HOSTS` env var. Reverse-proxy deployments that already canonicalise `Host` opt out with `--disable-host-validation`. The layer is wired into both the dedicated WebSocket router on `--ws-port` (8765) and the main HTTP router on `--http-port` (8080), so /ws/sensing on either listener is covered. Rejection responses are `421 Misdirected Request` (the correct status for a request that arrived at a server that does not consider the supplied `Host` authoritative); missing `Host` is `400 Bad Request`. CWE-346 (Origin Validation Error), CWE-350 (Reliance on Reverse DNS). Severity: high. Tests: 13 new unit tests on the middleware (loopback defaults, case-insensitivity, IPv6 bracketing, port stripping, env-var/CLI merge, foreign-host rejection on /health + /ws/*, disabled-allowlist escape hatch). Full suite: 220/220 pass under `cargo test -p wifi-densepose-sensing-server --no-default-features`. Co-authored-by: Aeon <aeon@aaronjmars.com>
24 lines
718 B
Rust
24 lines
718 B
Rust
//! WiFi-DensePose Sensing Server library.
|
|
//!
|
|
//! This crate provides:
|
|
//! - Vital sign detection from WiFi CSI amplitude data
|
|
//! - RVF (RuVector Format) binary container for model weights
|
|
//! - Opt-in bearer-token auth for the `/api/v1/*` HTTP surface (`bearer_auth`)
|
|
//! - Host-header allowlist / DNS-rebinding defense (`host_validation`)
|
|
//! - Real-time CSI introspection / low-latency tap (`introspection`, ADR-099)
|
|
|
|
pub mod bearer_auth;
|
|
pub mod host_validation;
|
|
pub mod introspection;
|
|
pub mod vital_signs;
|
|
pub mod rvf_container;
|
|
pub mod rvf_pipeline;
|
|
pub mod graph_transformer;
|
|
#[allow(dead_code)]
|
|
pub mod trainer;
|
|
pub mod dataset;
|
|
pub mod sona;
|
|
pub mod sparse_inference;
|
|
#[allow(dead_code)]
|
|
pub mod embedding;
|