Skip to content

mantis server 0.2.0

Choose a tag to compare

View all tags
@adamXbot adamXbot released this 05 Sep 10:03
· 17 commits to main since this release
v0.2.0
f0d7955
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security hardening release following the pre-launch audit (#86). Hit listings no longer expose admin-configured global webhook URLs to non-admin key owners, external_id claims by unrelated full keys are refused, installer templates neutralise hostile memos, API-key minting is admin-only, and MANTIS_PUBLIC_PATH finally routes.

Security

  • Global-destination targets redacted for non-admins. GET /api/keys/:id/hits and GET /api/hits/recent return target: null with a new destination_scope field (key / global / unknown) for rows a non-admin may not see. Global destinations are Slack / Discord / Teams / Home Assistant webhook credentials; only the key's own targets are shown to its owner. Admins are unchanged.
  • POST /api/keys with a foreign external_id. An unrelated full-scope key now gets 409 conflict (audited key.claimed with denied: true). An enrollment-scoped key that did not create the key still recovers the trigger URL — the documented re-image / key-rotation flow — but with memo: null and no routing, audited with cross_key: true.
  • Installer templates sanitise memo and hostname text before it lands in generated comments and YAML (a */ memo could previously become live JavaScript/CSS in the clone-detector, CSS canary and Scrypted snippets; a quoted newline could inject Home Assistant automation actions).
  • POST /api/api-keys is admin-only. Self-revoke is unchanged.
  • Bearer failures on session-or-key routes now consume the auth-failure limiter; /api/audit?actor= is validated (422); bulk-download and device-bundle enforce the 64 KiB JSON cap (413); /api/health no longer echoes the database driver error; the key page fingerprints the decrypted signing secret.

Fixed

  • MANTIS_PUBLIC_PATH works: the proxy rewrites <prefix>/<id> onto the trigger handler at runtime. Minted URLs under a custom prefix previously returned 404.

Changed

  • Dashboard secondary text lifted to WCAG AA contrast.
  • Fly and Render deploy templates enable hit / notification retention by default (90 / 30 days).

Upgrading

  • docker compose: git pull && docker compose up -d --build. No new migrations, no new required environment variables.
  • Integrators: notifications[].target may now be null; non-admin keys can no longer mint API keys; foreign external_id claims from full keys return 409.
  • CLI 0.2.1 renders the new notification shape (cli-v0.2.1).

Full diff: 42175e3...v0.2.0

Assets 2
Loading