fix(conn): require publish/play auth when only on_shared_object_cb is set - #321
Conversation
… set Servers that register only the shared-object delivery callback (without on_publish_cb/on_play_cb) implicitly authorized any peer to publish or play because requires_explicit_*_auth omitted on_shared_object_cb. Co-authored-by: Alexander Wagner <info@alexanderwagnerdev.com>
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@codex review |
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_57503b54-45dd-4393-acce-74918a854739) |
|
Codex Review: Didn't find any major issues. Breezy! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_e375246d-324b-48a5-92f1-e13bc452ca6d) |
|
2 participants
Security fix (closes #251)
Severity: High — authorization bypass on built-in relay servers
Location:
src/session/conn.rsImpact: A server that registers only
on_shared_object_cb(shared-object observer, noon_publish_cb/on_play_cb) implicitly allowed any peer topublish/play, enabling unauthorized ingest/playback and settingrelay_enabled.Root cause:
requires_explicit_publish_auth()/requires_explicit_play_auth()omittedon_shared_object_cb, unlikeon_shared_object_auth_cband other non-publish/play hooks.Fix: Include
on_shared_object_cbin both cross-gates; add regression tests mirroring the existingon_shared_object_auth_cbcoverage.Scan note: Re-validated on
253eaf86f1bba7b4c518e14fbbf2a2a799974a0cduring the 2026-09-23 scheduled review (already tracked as #251). Accidentally opened #320 as duplicate — closed.CI:
cargo test,cargo clippy --all-features --all-targets.Note
High Risk
Fixes a server-side authorization bypass that allowed unauthorized publish/play and relay on shared-object-observer-only configurations; behavior change for deployments that relied on the old implicit allow.
Overview
Security patch (0.9.1) closes an authorization bypass for RTMP servers that only register
on_shared_object_cbfor shared-object observation.requires_explicit_publish_auth()andrequires_explicit_play_auth()now treaton_shared_object_cblike other non-publish/play hooks (e.g.on_shared_object_auth_cb,on_media_cb), so publish and play are denied when noon_publish_cb/on_play_cbis configured—relay_enabledstays off instead of implicitly enabling ingest, playback, and relay. Regression tests cover publish and play on shared-object-only setups.Release metadata: crate version 0.9.0 → 0.9.1, plus matching CHANGELOG and debian/changelog entries.
Reviewed by Cursor Bugbot for commit 89ef0dc. Bugbot is set up for automated code reviews on this repo. Configure here.
Release preparation
0.9.0to0.9.1.CHANGELOG.md.0.9.1-1entry todebian/changelog.