From 6f9d11f83eaeb9e808a3f74363ed8ee0b182a847 Mon Sep 17 00:00:00 2001 From: reverse Date: Wed, 19 Aug 2026 01:18:13 +0000 Subject: [PATCH] =?UTF-8?q?captcha:=20clamp=20recaptcha/cloudflare=20token?= =?UTF-8?q?=20TTL=20to=20[60s,=2086400s]=20=E2=80=94=20an=20unclamped=20co?= =?UTF-8?q?nf=20value=20could=20set=20exp=20in=20the=20past=20(every=20tok?= =?UTF-8?q?en=20instantly=20invalid,=20self-DoS)=20or=20absurdly=20far=20o?= =?UTF-8?q?ut?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- src/modules/cloudflare_challenge.rs | 4 +++- src/modules/recaptcha.rs | 4 +++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/src/modules/cloudflare_challenge.rs b/src/modules/cloudflare_challenge.rs index 6bc655c..8aab8c6 100644 --- a/src/modules/cloudflare_challenge.rs +++ b/src/modules/cloudflare_challenge.rs @@ -51,7 +51,9 @@ fn port_whitelisted(s: &Server, uid: Uid) -> bool { fn make_token(s: &Server, uid: Uid) -> Option { let secret = s.conf("cloudflare_secret")?; let issuer = s.conf("cloudflare_issuer").unwrap_or("echoIRCd"); - let ttl = s.conf_num("cloudflare_ttl", 1800i64); + // clamp to a sane positive window (a negative/absurd ttl would put exp in the + // past — instant self-DoS — or far future) + let ttl = s.conf_num("cloudflare_ttl", 1800i64).clamp(60, 86400); let ip = s.users.get(&uid)?.addr.ip().to_string(); let n = now() as i64; let claims = format!( diff --git a/src/modules/recaptcha.rs b/src/modules/recaptcha.rs index 6d44d51..aacc57b 100644 --- a/src/modules/recaptcha.rs +++ b/src/modules/recaptcha.rs @@ -60,7 +60,9 @@ fn port_whitelisted(s: &Server, uid: Uid) -> bool { fn make_token(s: &Server, uid: Uid) -> Option { let secret = s.conf("recaptcha_secret")?; let issuer = s.conf("recaptcha_issuer").unwrap_or("echoIRCd"); - let ttl = s.conf_num("recaptcha_ttl", 1800i64); + // clamp to a sane positive window: a negative/absurd ttl would put exp in the + // past (instant self-DoS) or far future + let ttl = s.conf_num("recaptcha_ttl", 1800i64).clamp(60, 86400); let ip = s.users.get(&uid)?.addr.ip().to_string(); let n = now() as i64; let claims = format!(