#79 finding 5 (HIGH): unthrottled DM invite auto-join + unrotated audit.jsonl; trust is_direct #85

New issue

Closed

opened 2026-07-11 09:08:06 +00:00 by robocub · 1 comment

robocub commented

2026-07-11 09:08:06 +00:00

Collaborator

From the #79 review. Not fixed.

handle_invite accepts every non-banned DIRECT invite under open_registration and appservice-joins with NO rate limit or cap → a Sybil swarm of DM invites grows the bot's joined-room set without bound (memory + sync latency on the single process).
audit.jsonl is opened append-only with NO rotation/size cap → invite/link/report spam fills the data-dir disk.
handle_invite trusts the inviter-set is_direct flag as proof of a DM without checking joined_members_count, so a self-serve user can pull the bot into a multi-user room and trigger a greeting there (a second, un-rate-limited seeding path). (The command path itself is still gated by is_command_room, so this is greeting-leak + join, not command execution.)

Fix

Cap + rate-limit invite acceptance per sender and globally; leave idle/empty DM rooms after a TTL; rotate/size-bound audit.jsonl and rate-limit audit writes per actor; verify joined_members_count <= 2 before treating an accepted invite as a real DM (post-join).

Severity HIGH (DoS/disk).

From the #79 review. **Not fixed.** - `handle_invite` accepts every non-banned DIRECT invite under open_registration and appservice-joins with NO rate limit or cap → a Sybil swarm of DM invites grows the bot's joined-room set without bound (memory + sync latency on the single process). - `audit.jsonl` is opened append-only with NO rotation/size cap → invite/link/report spam fills the data-dir disk. - `handle_invite` trusts the inviter-set `is_direct` flag as proof of a DM without checking `joined_members_count`, so a self-serve user can pull the bot into a multi-user room and trigger a greeting there (a second, un-rate-limited seeding path). (The command path itself is still gated by `is_command_room`, so this is greeting-leak + join, not command execution.) ## Fix Cap + rate-limit invite acceptance per sender and globally; leave idle/empty DM rooms after a TTL; rotate/size-bound `audit.jsonl` and rate-limit audit writes per actor; verify `joined_members_count <= 2` before treating an accepted invite as a real DM (post-join). Severity HIGH (DoS/disk).

robocub referenced this issue

2026-07-11 09:08:28 +00:00

Pre-launch adversarial security + abuse review of the open-registration surface (run on Fable) #79

robocub referenced this issue from a commit

2026-07-11 16:19:23 +00:00

fix(mgmt,config): #83/#84/#85 open-registration hardening (core)

robocub referenced this issue from a commit

2026-07-11 16:26:35 +00:00

fix(mgmt,config): #83/#84/#85 open-registration hardening (core)

robocub referenced this issue

2026-07-11 16:51:02 +00:00

#85 residual: per-sender invite cooldown + idle DM-room TTL leave #89

robocub commented

2026-07-11 16:51:31 +00:00

Author

Collaborator

Core fixed + shipped in v0.3.0-alpha.18 (deployed 2026-07-11). audit.jsonl rotates to .1 at 64 MiB; an accepted DM invite found to have >2 members (spoofed is_direct) is left instead of greeted. Residual (per-sender invite cooldown + idle DM-room TTL leave) tracked in #89.

Core fixed + shipped in **v0.3.0-alpha.18** (deployed 2026-07-11). `audit.jsonl` rotates to `.1` at 64 MiB; an accepted DM invite found to have >2 members (spoofed `is_direct`) is left instead of greeted. Residual (per-sender invite cooldown + idle DM-room TTL leave) tracked in #89.

robocub closed this issue

2026-07-11 16:51:31 +00:00

robocub referenced this issue from a commit

2026-07-13 17:27:34 +00:00

feat(mgmt): awaiting-invite link resume — self-serve link of invite-only rooms (#111)

robocub referenced this issue

2026-07-13 17:27:57 +00:00

feat(mgmt): awaiting-invite link resume — self-serve link of invite-only rooms (#111) #119

robocub referenced this issue

2026-07-13 17:45:39 +00:00

mgmt: self-serve link of an invite-only room is unsatisfiable — the invite gate rejects the invite the link reply instructs #111

robocub referenced this issue