Skip to content

SECURITY.md

Latest commit

 

History

History
82 lines (52 loc) · 3.61 KB

SECURITY.md

File metadata and controls

82 lines (52 loc) · 3.61 KB
Raw

Security and resource limits

Deployment boundary

Proxy List Processor supports two deployment profiles:

  • public: session-scoped history, public rate limits, 24-hour result retention and a 250 MiB runtime quota;
  • private: shared history, 14-day result retention, disabled public rate limits and a 1 GiB runtime quota.

Private mode does not enable authentication. Protect panel/ using the web server, reverse proxy, VPN or another external access-control mechanism.

Generated subscription files are intentionally reachable by their random URLs. Treat each URL as a bearer link.

Runtime storage

Bundled Apache .htaccess files deny HTTP access to panel/storage/ and its sensitive subdirectories. For nginx configure an equivalent rule:

location ^~ /proxy-list-processor/panel/storage/ {
    deny all;
    return 404;
}

Do not expose history records, logs, temporary files, lock files or rate-limit state over HTTP.

Session ownership

In public mode every browser session receives a random owner token stored in the PHP session. History and deletion are filtered by the SHA-256 owner identifier stored with each result. Losing the session cookie also loses access to that result through the panel, although a known direct result URL remains usable until cleanup.

CAPTCHA, CSRF and rate limiting

The one-time mathematical CAPTCHA is a lightweight anti-automation measure. All state-changing endpoints require CSRF protection.

Public mode additionally enforces:

  • 3 processing attempts per IP address in 10 minutes;
  • 20 processing attempts for the whole installation per hour;
  • one active processing operation at a time.

The limiter uses REMOTE_ADDR by default. X-Forwarded-For is accepted only when the immediate peer is explicitly listed in trusted_proxy_ips; arbitrary forwarded headers are ignored.

URL loading and SSRF

The URL loader accepts only HTTP/HTTPS, blocks URL credentials and PHP-classified non-public IP ranges, validates every redirect, pins the validated DNS result, verifies TLS, streams the response to disk and enforces size/time limits.

Extended CIDR classification and a configurable source-port allowlist remain planned hardening work. Deployments with stricter requirements should also enforce egress rules at the network level.

Browser security

The panel sends:

  • Cache-Control: no-store, private;
  • Content Security Policy;
  • X-Content-Type-Options: nosniff;
  • X-Frame-Options: DENY;
  • Referrer-Policy: no-referrer;
  • a restrictive Permissions-Policy.

Session cookies use HttpOnly, SameSite=Strict and Secure when PHP detects HTTPS. When TLS terminates at a trusted reverse proxy, add only that proxy IP to trusted_proxy_ips.

Output and display names

All subscription-derived values are untrusted. HTML output is escaped, JavaScript uses DOM text nodes, and result names are URI-encoded. Generated display names also remove ASCII control characters and Unicode bidirectional-control marks.

Logging

Production logs contain error codes, exception classes and bounded non-sensitive context. Extended exception messages are written only when debug_logging is enabled and are sanitized for proxy and HTTP URIs and common embedded secret fields. Complete proxy URIs, credentials, UUIDs, tokens and source content must never be logged.

Default processing limits

Both profiles intentionally allow a complete Epodonios protocol list in one valid operation:

POST body             12 MiB
upload                10 MiB
remote response       10 MiB
decoded text           8 MiB
lines                 25,000
one URI               16,384 bytes
selected configs      20,000