Dionisio 98fb3e6408 fix(security): VULN-01 admin escalation + VULN-02 path traversal hardening ...

VULN-01 - Admin privilege escalation:
- Harden register() to reject is_admin=true
- Add /api/setup endpoint with setup_token for initial admin creation
- Add SetupAdminDto and setup_token to AppState
- Remove dead code from auth handler

VULN-02 - Path traversal (CVSS ~8.6):
- Solution A+E: Harden StoragePath constructors (from_string, new, join)
  to strip '..' and '.' segments and reject slash injection
- Solution B: resolve_path() now returns Result<PathBuf>, calls
  validate_path() internally, and verifies resolved path stays under root
- Update StoragePort trait signature to return Result<PathBuf, DomainError>
- Remove dead code: FilePathResolutionPort, StorageVerificationPort,
  DirectoryManagementPort (declared but never implemented)
- Add 17 security tests covering traversal attack vectors

2026-03-04 14:14:40 +01:00

..

auth_ports.rs

perf: replace dyn trait objects with concrete types to eliminate vtable overhead

2026-03-03 15:36:42 +00:00

cache_ports.rs

perf: replace dyn trait objects with concrete types to eliminate vtable overhead

2026-03-03 15:36:42 +00:00

calendar_ports.rs

perf: replace dyn trait objects with concrete types to eliminate vtable overhead

2026-03-03 15:36:42 +00:00

carddav_ports.rs

perf: replace dyn trait objects with concrete types to eliminate vtable overhead

2026-03-03 15:36:42 +00:00

chunked_upload_ports.rs

perf: replace dyn trait objects with concrete types to eliminate vtable overhead

2026-03-03 15:36:42 +00:00

compression_ports.rs

perf: replace dyn trait objects with concrete types to eliminate vtable overhead

2026-03-03 15:36:42 +00:00

dedup_ports.rs

perf: replace dyn trait objects with concrete types to eliminate vtable overhead

2026-03-03 15:36:42 +00:00

favorites_ports.rs

perf: replace dyn trait objects with concrete types to eliminate vtable overhead

2026-03-03 15:36:42 +00:00

file_ports.rs

perf: use Arc<str> for repetitive DTO fields to eliminate clone allocations

2026-03-03 15:55:15 +00:00

inbound.rs

perf: replace dyn trait objects with concrete types to eliminate vtable overhead

2026-03-03 15:36:42 +00:00

mod.rs

style: apply cargo fmt to entire codebase

2026-02-14 01:29:34 +01:00

outbound.rs

fix(security): VULN-01 admin escalation + VULN-02 path traversal hardening

2026-03-04 14:14:40 +01:00

recent_ports.rs

perf: replace dyn trait objects with concrete types to eliminate vtable overhead

2026-03-03 15:36:42 +00:00

share_ports.rs

perf: replace dyn trait objects with concrete types to eliminate vtable overhead

2026-03-03 15:36:42 +00:00

storage_ports.rs

fix(security): VULN-01 admin escalation + VULN-02 path traversal hardening

2026-03-04 14:14:40 +01:00

thumbnail_ports.rs

perf: replace dyn trait objects with concrete types to eliminate vtable overhead

2026-03-03 15:36:42 +00:00

transcode_ports.rs

perf: replace dyn trait objects with concrete types to eliminate vtable overhead

2026-03-03 15:36:42 +00:00

trash_ports.rs

perf: replace dyn trait objects with concrete types to eliminate vtable overhead

2026-03-03 15:36:42 +00:00

zip_ports.rs

perf: replace dyn trait objects with concrete types to eliminate vtable overhead

2026-03-03 15:36:42 +00:00