Skip to content

v0.5.0

Choose a tag to compare

View all tags
@MathieuDubart MathieuDubart released this 23 Apr 21:31
v0.5.0
7cef7e9

Security hardening — internal audit (Blocs A–D + Bloc B)

Upgrade recommended. No breaking changes.

Security

  • [D3] Cross-domain redirect blocking — RedirectGuard in URLSessionTransport blocks redirects to untrusted hosts, surfaces SwiftSonicError.insecureRedirect(from:to:).
  • [A3] Salt 16 chars + explicit SystemRandomNumberGenerator (CSPRNG).
  • [D2] HTTP plain-text warning via dedicated os.Logger (com.swiftsonic/security), always active.
  • [D4] requestTimeout floor of 1 second in ServerConfiguration.init.
  • [C1] SwiftSonicError conforms to LocalizedError with credential-safe descriptions.
  • [B1/B2] URL.safeDescription internal helper + 19 canary-value no-leak regression tests.

Added

  • SwiftSonicError.insecureRedirect(from:to:) new error case.
  • URL.safeDescription internal helper.

Tests

253 tests, 0 failures.

Full changelog: https://github.com/MathieuDubart/swiftsonic/blob/main/CHANGELOG.md

Assets 2
Loading