fix: address aisafe.io security audit findings

[adrgs]

Summary

Fixes 15 security findings from the aisafe.io audit report. All changes are minimal, targeted, and avoid introducing new dependencies.

Triage

Accepted & Fixed

ID	Reported Severity	Actual Severity	Summary	Fix
RQS-004	High	High	JWT type confusion: share token accepted as session token	#[serde(deny_unknown_fields)] on Claims struct
RQS-006	High	High	DNS amplification via huge TXT records	TXT records capped at 512 chars + UDP TC bit truncation
RQS-008	High	High	O(N*M) cache eviction loop holds write lock	Keys collected once outside while loop
RQS-005	High	Medium	Cross-tenant quota bypass via subdomain extraction	Rewrote DNS key parsing to strip base domain properly
RQS-007	Medium	Medium	Request deletion hits wrong item after eviction	Removed fragile index system, scan list by ID
RQS-013	High	Medium	TCP connections unbounded + no read timeout	Semaphore (100 conns/port) + 30s read timeout
RQS-003	High	Medium	SMTP transaction_log grows unbounded	64KB log cap, 500 cmd limit, 100 recipient limit

Accepted but Overstated Severity

ID	Reported	Actual	Summary	Notes
RQS-015	Critical	Low	Panic on multi-byte UTF-8 Host header	Tokio catches task panics — only kills the single request handler, not the server. Still fixed (good practice).
RQS-014	High	Low	WebSocket loads all history on connect	Bounded by max_requests_per_session already. A per-connection memory burst doesn't OOM the server. Capped to last 100 anyway.
RQS-009	High	Low	request: keys leak in kv_store	Real but very slow leak (keys are ~50 bytes each). Fixed by removing index system + recognizing prefix.
RQS-002	High	Low/By Design	XSS via file upload	Serving custom HTML/JS on subdomains IS the core feature. Added sandbox CSP + nosniff as defense-in-depth.
RQS-001	Info	Info	Timing attack on admin token	Not exploitable over network (jitter >> nanosecond differences). Fixed with constant-time compare anyway.
RQS-012	Low	Low	No DNS/TCP rate limiting	Added per-IP DNS rate limiter (100 qps). TCP bounded by semaphore.
RQS-011	Low	Low	No WebSocket rate limiting	Added 30 msg/s per-connection limit.
RQS-010	Low	Low	No share token rate limiting	Added 10 req/60s per-IP limit.

Feedback for aisafe.io

1. RQS-015 severity is wrong. Rated Critical, but Tokio task panics are isolated — they kill one request handler, not the server. The report claims "continuously abort all Tokio worker tasks" and "severely disrupts overall server stability" which is false. A panic in a spawned task is caught by the Tokio runtime. This is Low severity at most.

2. RQS-014 impact is overstated. Claims "uncatchable Out-Of-Memory (OOM) panic terminating the application instance across the entire environment." The request list is already bounded by max_requests_per_session. Loading 100 requests × a few KB each is not going to OOM anything.

3. RQS-002 is by design. RequestRepo is a security research tool — serving custom HTTP responses with user-controlled headers and bodies is the primary feature. The report treats this as a vulnerability. We added CSP sandbox as defense-in-depth, but this isn't really a finding.

4. Multiple findings describe request-level failures as server-wide crashes. Tokio isolates task panics. A single request failing does not constitute a DoS against the server. The report repeatedly uses language like "entire environment" and "all tenants" for per-task issues.

5. RQS-001 timing attack is not practical. The report correctly notes this but still files it. Network jitter is orders of magnitude larger than comparison timing differences.

6. RQS-005 PoC is incorrect. The PoC shows unauthenticated API calls but the DNS endpoint requires JWT auth. The subdomain in the FQDN is constructed server-side from the authenticated session. The actual attack surface is narrower than described.

Performance notes

• RQS-008 fix is a pure perf improvement (removed redundant allocations under write lock)
• DNS rate limiter uses Mutex<HashMap> with periodic cleanup — minimal overhead at 100 qps threshold
• Request deletion is now O(n) scan instead of O(1) index lookup, but n ≤ max_requests_per_session (bounded, typically ~100-500)
• WebSocket history sends fewer items on connect (100 vs all) — net improvement

Test plan

• All 79 tests pass (1 ignored: ACME staging, requires real domain)
• cargo clippy -- -D warnings clean
• cargo fmt applied
• Manual test: multi-byte UTF-8 Host header no longer panics
• Manual test: share token rejected when used as session token
• Manual test: TXT records >512 chars rejected by API
• Manual test: WebSocket disconnects at >30 msg/s

🤖 Generated with Claude Code