Findings
correctness
crates/paroche/src/subsonic/playlists.rs:435 — delete_playlist silently succeeds when playlist does not exist or belongs to another user (low)
resilience
crates/paroche/src/subsonic/playlists.rs:336 — Non-atomic ownership check then write in update_playlist allows TOCTOU mutation by concurrent request (low)crates/paroche/src/subsonic/playlists.rs:381 — update_playlist song-append position calculation races on concurrent appends to the same playlist (low)
security
crates/paroche/src/subsonic/auth.rs:70 — MD5 token comparison is not constant-time — timing oracle on legacy Subsonic auth (low)
Note
These are batched low/info findings; split any out if it gets prioritized.
Findings
correctness
crates/paroche/src/subsonic/playlists.rs:435— delete_playlist silently succeeds when playlist does not exist or belongs to another user (low)resilience
crates/paroche/src/subsonic/playlists.rs:336— Non-atomic ownership check then write in update_playlist allows TOCTOU mutation by concurrent request (low)crates/paroche/src/subsonic/playlists.rs:381— update_playlist song-append position calculation races on concurrent appends to the same playlist (low)security
crates/paroche/src/subsonic/auth.rs:70— MD5 token comparison is not constant-time — timing oracle on legacy Subsonic auth (low)Note
These are batched low/info findings; split any out if it gets prioritized.