Skip to content

Release 0.3.10

Latest
Latest

Choose a tag to compare

View all tags
@cyberjunky cyberjunky released this 11 Aug 07:07
0.3.10
414b540

What's Changed

This release is primarily a security-hardening pass covering authentication, token storage, and request handling.

Security

Token storage & session

  • Reject symlinked tokenstore paths, including intermediate directories anywhere in the path's ancestry and ~username expansion — closes several local-attacker vectors that could redirect token read/write/delete to an attacker-controlled location.
  • Token refresh and writes are now serialized with a lock and written atomically, preventing corrupted or raced token files.
  • logout() now fully clears session cookies, MFA state, and wrapper fields instead of leaving stale credentials behind.
  • Plaintext password is cleared from memory after a successful login.

Authentication flow

  • login() clears stale auth state on entry, so a failed or partial login can no longer leave a mismatched token active.
  • Two-step MFA (resume_login) now verifies the resulting token and fails closed instead of silently succeeding with a broken session.
  • Interleaved MFA logins on a shared client instance no longer corrupt each other's pending state.
  • JWT handling rejects unsigned (alg: none) tokens and malformed/adversarial exp claims that could otherwise crash every subsequent API call.

Request & URL handling

  • All identifier-bearing API methods now validate their inputs (positive integers, UUIDs, sport keys, dates) before building request URLs, closing several path-traversal and query-injection gaps.
  • The request-path guard now correctly decodes percent-encoded paths before validating them, and no longer misfires on legitimate encoded characters.
  • domain= is now checked against an allowlist of official Garmin domains, preventing credential exfiltration via a malicious value.

Reliability / DoS

  • Pagination in get_activities_by_date / get_goals is now capped, so a misbehaving or hostile server can no longer hang the client or exhaust memory.
  • A 401 during upload retry now rewinds the file body correctly instead of silently re-uploading an empty or truncated file.

Logging & data hygiene

  • Exception messages and debug logs no longer include raw server response bodies, CAS service tickets, or token contents.
  • Hardened the VCR cassette sanitizer (JSON bodies, MFA codes, tickets) and the exercise-catalog generator script against recording or publishing session/account data.

Full Changelog: 0.3.9...0.3.10

Assets 2
Loading