NovaSync

NovaSync 2.17.146 — Launch-readiness auth/HTTP sweep

Final pre-launch hardening pass over the publicly-exposed dashboard + HTTP API surface, driven by a cross-vendor trio review (DeepSeek V4-Pro + Gemini 3.1-Pro + java-plugin specialist agent). Four findings landed; ~15 lower-severity items were triaged into a follow-up hardening sprint.

What changed

• Role-delete now refuses on active members. RoleApiHandler previously had dead-code: the active-member guard always evaluated false, so any role — including built-in or admin-occupied roles — could be deleted in one click. Replaced with a real SELECT COUNT(*) FROM dashboard_admins WHERE role = ? COLLATE NOCASE and HTTP 409 with the count when non-zero.

• Constant-time api-key compare on Java HTTP routes. /api/command, /api/health, and /api/block-lookup were comparing authHeader.equals(finalApiKey). Replaced with MessageDigest.isEqual on UTF-8 bytes across all three. Closes a remote timing oracle on the shared HTTP API key.

• Double-submit CSRF check on /api/command session-cookie path. Previously the endpoint accepted any same-origin POST with a valid nova-session cookie, with no X-Dashboard-Token validation. A malicious cross-origin page could drive arbitrary server commands as the logged-in admin. The api-key path (used by the Nova mod) is unaffected — it never sets the session cookie.

• evtBadge() XSS fix. The activity-feed badge was interpolating server-controlled e.type straight into innerHTML. Wrapped through the canonical esc() helper that already guards every other dynamic-HTML insertion in the dashboard.

Verification

• Cross-vendor trio review (Gemini 3.1-Pro + DeepSeek V4-Pro) confirmed all four fixes; two single-vendor "ship-block" findings were caught as false positives by reading the actual code paths before fixing.
• Full nuke + reinstall of the EU node from the public install.nova-ai.online | bash path: cold-boot succeeded in 17.3 s, owner-setup wizard reachable, dashboard login + role page + command endpoint all healthy.
• Live on SA Hyperlayer + EU Hetzner + laptop test node; Fast and Slow website channels both point at 2.17.146.

Continuity with 2.17.145

This release sits on top of the full 2.17.134 → 2.17.145 Mojang-route resilience series (MojangRetryProxy v2, MojangPublicKeysCache, Geyser cooldown-type patch, BedrockSkinFix is_steve boolean parse). All of that is included — no behavior changes vs 2.17.145 outside the four auth/HTTP fixes above.

Tested on Paper 1.21.11 + Java 21 with Geyser-Spigot 2.10.0 and Floodgate 2.2.5.