Skip to content

v0.5.5

Choose a tag to compare

View all tags
@sscarduzio sscarduzio released this 01 Apr 11:40
· 2232 commits to main since this release
v0.5.5
78953a5

Critical Bugfix

  • Fix presigned URL replay false positives: Presigned URLs were being rejected as "replay attacks" because they have fixed signatures by design. The replay cache now skips presigned URLs entirely (they have their own expiry mechanism via X-Amz-Expires).
  • Reduce replay window: Regular SigV4 replay detection window reduced from 300s to 2s (configurable via DGP_REPLAY_WINDOW_SECS). The 300s window was too aggressive — identical requests within the same second produce the same SigV4 signature legitimately.

Config DB Recovery

  • Bootstrap password mismatch recovery wizard: When the bootstrap hash doesn't match the existing config DB, the proxy preserves the DB as .db.bak, blocks S3 API access, and shows a recovery wizard in the admin GUI to restore the correct hash.
  • S3 API locked during mismatch: Prevents unauthenticated data access when config DB can't be decrypted.

Correctness Fixes (Security Audit)

  • Bucket name validation: Consolidated — start/end alphanumeric now checked everywhere
  • Session IP binding: Strict enforcement — missing IP no longer bypasses binding
  • Multipart double-completion: Atomic write-lock prevents concurrent complete() race
  • Codec env var: Fixed DGP_CODEC_TIMEOUT_SECS (was mangled during refactor)
  • Continuation tokens: Invalid base64/UTF-8 tokens now rejected instead of silently accepted

UI Improvements

  • Admin Settings link: Shows for IAM admin users (auto login-as on connect)
  • Metrics dashboard: Fixed endpoint paths (/_/metrics, /_/stats)
  • API docs: Method pills use translucent backgrounds for better dark mode contrast
  • Recovery wizard: Left-aligned text, proper sans-serif fonts, persistent success state
  • Global contrast: TEXT_MUTED/TEXT_FAINT brightened, base font 14px

Infrastructure

  • CI parallelization: 8 concurrent jobs (3 test groups + 5 checks)
  • Interop test isolation: Each test proxy gets its own config DB and port range

Full Changelog: v0.5.4...v0.5.5

Full Changelog: v0.5.7...v0.5.5

Assets 8
Loading