From d8a361bdcfaa8cc5b39d9675e74b0e1d2e42be2c Mon Sep 17 00:00:00 2001 From: Adam Soltys Date: Sun, 13 Sep 2026 20:44:48 -0700 Subject: security: drop the admin endpoint surface and land pending hardening Removes the admin-gated endpoints and the account flags they set, plus a batch of hardening that had accumulated uncommitted in the tree. These were deployed and verified together, so they land as one change. admin surface: - drop POST /hidepay, POST /unlimit and GET /users, their handlers, and the now-unused admin preValidation export - `unlimited` was only ever written, never read; `hidepay` only appeared in output projections. Both flags go, along with their whitelist, public-fields and type entries. request log: - redactBody now recurses. It only masked top-level keys, so a body that nests credentials one level down wrote them to the log in plaintext, and pin fields were not on the list at all. payments: - sendOnchain/build gate `aid` through requireAccount, so a caller can only spend from an account it owns - sendOnchain signs only a tx we composed, matched against a short-lived per-account build receipt - raise xpay retry_for to 60s; route-finding preferred a drained zero-fee hop and burned the whole budget on it. check()'s reversal window keeps its 2x margin. ecash / invoices / webhooks: - resolve a token's mint through the IP-pinning fetcher instead of plain fetch, closing an unauthenticated SSRF path into the internal network - reject non-positive amounts before the balance write - /sign requires the caller to own the address, rather than signing under any address the hot wallet controls - webhook delivery no longer disables TLS verification; the body carries the merchant's shared secret registration: - refuse a username the v3 registrar holds unless the caller's own nostr key is the holder (lib/names.ts) liquid: - honour the deposit kill switch at invoice generation and at credit elements image: - pin 23.3.4 and verify the release tarball checksum Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_0112TGi9GGNWqji1XQ5jZRzc --- docker/elements.Dockerfile | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) (limited to 'docker/elements.Dockerfile') diff --git a/docker/elements.Dockerfile b/docker/elements.Dockerfile index 98cba809..3351be82 100644 --- a/docker/elements.Dockerfile +++ b/docker/elements.Dockerfile @@ -1,7 +1,10 @@ FROM ghcr.io/coinos/base AS builder -ARG VERSION=23.3.2 +ARG VERSION=23.3.4 +ARG SHA256=a758151ace3f21008ab162067ffce9e0e526a1b5d55995e2c30d9cd7ccda41a0 USER root -RUN wget -qO- https://github.com/ElementsProject/elements/releases/download/elements-$VERSION/elements-$VERSION-x86_64-linux-gnu.tar.gz | tar -xz --strip-components=1 -C /usr/local +RUN wget -qO /tmp/elements.tar.gz https://github.com/ElementsProject/elements/releases/download/elements-$VERSION/elements-$VERSION-x86_64-linux-gnu.tar.gz \ + && echo "$SHA256 /tmp/elements.tar.gz" | sha256sum -c - \ + && tar -xz --strip-components=1 -C /usr/local -f /tmp/elements.tar.gz && rm /tmp/elements.tar.gz FROM ghcr.io/coinos/base USER root -- cgit v1.2.3