Security

A media server for a household that can be reached from the internet, holding an administrator account on every backend behind it. This section says who it defends against, how, and what ten review passes found.

The shape of the problem

Three things make SoundStorm a bigger target than its size suggests:

• It holds the keys to everything behind it. It created every backend's administrator account and keeps the credentials. A request that can steer what SoundStorm asks a backend for is a request made with an administrator's credentials.
• Its users upload files that other users open. A member can drop an EPUB, an MP3, a photo or a zip; the owner may open it later. Every parser is reading somebody else's bytes, and a book's HTML is rendered on SoundStorm's own origin.
• It can face the internet. Remote access gives each install a public name and opens a port on the router. Anything unauthenticated - sign-in above all - is answered for strangers.

Principles that recur

• The context carries who is asking. Access to a kind of media is not checked by each handler remembering to: the registry only hands out sources through the request's context, so the compiler finds every call site.
• Normalize and refuse at the edge. Paths, ids and backend answers are cleaned where they enter, and a shared HTTP client refuses dot segments and absolute references for every adapter.
• Nothing a browser would run is served as runnable. Script types become text/plain; HTML, XML and SVG get a sandbox policy; book parts can only be fetched, not loaded as scripts or frames.
• Every write has a ceiling. State files, collections, positions, plays, imports and uploads are bounded and rate limited, because the file every login rewrites is the one an attacker would grow.
• A background goroutine recovers. net/http protects only its own goroutines; every loop SoundStorm starts catches a panic, so one crafted file cannot take the server down.
• A check that cannot see the failure is believed anyway. Tests go through the real route chain, and fixes are confirmed by reproducing the attack first.