fix: cora scan findings — v0.1.1 patch release (#203)

Fixes from Cora scan (62 issues → 5 actionable fixed):

#196 — Rate limiter Mutex poison panic
  Mutex::lock().unwrap() → unwrap_or_else(into_inner)

#202 — Blocking DNS in SSRF check
  is_private_url() wrapped in tokio::task::spawn_blocking

#197 — IP spoofing via X-Forwarded-For
  Validate as IpAddr, take first entry only

#198 — Webhook timeout too long
  10s → 5s

#201 — EventRow silent data loss
  serde_json parse failure now logs warning via tracing

Issues closed: #196, #197, #198, #200 (no-op), #201, #202
Issue deferred: #199 (password validation — enhancement)

Author: ajianaz

CHANGELOG.md

@@ -7,6 +7,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.1.1] - 2026-06-16
+
+### Fixed
+
+- **Rate limiter panic** (#196): `Mutex::lock().unwrap()` replaced with
+  poison-recovery pattern `unwrap_or_else(|e| e.into_inner())`
+- **Blocking DNS in SSRF check** (#202): `is_private_url` now runs via
+  `tokio::task::spawn_blocking` to avoid blocking async runtime
+- **IP spoofing via X-Forwarded-For** (#197): Extracted IP now validated
+  as `IpAddr` and only first entry taken from comma-separated list
+- **Webhook timeout** (#198): Reduced from 10s to 5s
+- **EventRow silent data loss** (#201): JSON parse failures now logged
+  via `tracing::warn` before falling back to null
+
 ## [0.1.0] - 2026-06-16
 
 ### Added
@@ -168,7 +182,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - 24 audit findings addressed across 6 batch PRs (#121–#126)
 
-[unreleased]: https://github.com/codecoradev/trapfall/compare/v0.1.0...develop
+[unreleased]: https://github.com/codecoradev/trapfall/compare/v0.1.1...develop
+[0.1.1]: https://github.com/codecoradev/trapfall/compare/v0.1.0...v0.1.1
 [0.1.0]: https://github.com/codecoradev/trapfall/compare/v0.0.5...v0.1.0
 [0.0.5]: https://github.com/codecoradev/trapfall/compare/v0.0.4...v0.0.5
 [0.0.4]: https://github.com/codecoradev/trapfall/compare/v0.0.3...v0.0.4

Cargo.lock

@@ -13,7 +13,7 @@ members = [
 ]
 
 [workspace.package]
-version = "0.1.0"
+version = "0.1.1"
 edition = "2024"
 license = "Apache-2.0"
 repository = "https://github.com/codecoradev/trapfall"

Cargo.toml

@@ -69,13 +69,11 @@ pub struct EventRow {
 
 impl From<EventRow> for StoredEvent {
     fn from(r: EventRow) -> Self {
-        Self {
-            id: r.id,
-            issue_id: r.issue_id,
-            project_id: r.project_id,
-            data: serde_json::from_str(&r.data).unwrap_or(serde_json::Value::Null),
-            received_at: r.received_at,
-        }
+        let data = serde_json::from_str(&r.data).unwrap_or_else(|e| {
+            tracing::warn!("Failed to parse event data JSON: {e}");
+            serde_json::Value::Null
+        });
+        Self { id: r.id, issue_id: r.issue_id, project_id: r.project_id, data, received_at: r.received_at }
     }
 }
 

crates/trapfall-db/src/common.rs

@@ -100,7 +100,9 @@ async fn dispatch_webhook(rule: &AlertRule, issue: &Issue) -> anyhow::Result<()>
         .ok_or_else(|| anyhow::anyhow!("no url in action_config"))?;
 
     // SSRF protection: block internal/private IPs
-    if is_private_url(url) {
+    let url_owned = url.to_string();
+    let is_private = tokio::task::spawn_blocking(move || is_private_url(&url_owned)).await.unwrap_or(true);
+    if is_private {
         tracing::warn!("Webhook URL blocked (private/internal IP): {url}");
         anyhow::bail!("webhook URL points to private/internal address");
     }
@@ -120,7 +122,7 @@ async fn dispatch_webhook(rule: &AlertRule, issue: &Issue) -> anyhow::Result<()>
         }
     });
 
-    let resp = REQWEST_CLIENT.post(url).json(&payload).timeout(std::time::Duration::from_secs(10)).send().await?;
+    let resp = REQWEST_CLIENT.post(url).json(&payload).timeout(std::time::Duration::from_secs(5)).send().await?;
 
     if resp.status().is_success() {
         tracing::info!("Webhook dispatched to {url} for rule '{}'", rule.name);
@@ -182,6 +184,7 @@ fn ip_is_private(ip: std::net::IpAddr) -> bool {
 }
 
 /// Resolve a hostname to IP addresses (blocking DNS lookup).
+/// Called via spawn_blocking to avoid blocking the tokio runtime.
 fn dns_resolve_host(host: &str) -> std::io::Result<Vec<std::net::IpAddr>> {
     use std::net::ToSocketAddrs;
     // Append port 443 for resolution (required by ToSocketAddrs)

crates/trapfalld/src/alert.rs

@@ -147,11 +147,13 @@ pub async fn login(
 ) -> Result<(StatusCode, [(String, String); 1], Json<LoginResponse>), (StatusCode, Json<AuthErrorJson>)> {
     let store = state.store.clone();
 
-    // Extract client IP (best-effort)
+    // Extract client IP (best-effort, first IP from XFF, validated)
     let ip = headers
         .get("x-forwarded-for")
         .or_else(|| headers.get("x-real-ip"))
         .and_then(|v| v.to_str().ok())
+        .and_then(|s| s.split(',').next().map(|s| s.trim()))
+        .filter(|s| s.parse::<std::net::IpAddr>().is_ok())
         .unwrap_or("unknown");
 
     match store.authenticate(&req.email, &req.password, ip).await {

crates/trapfalld/src/auth.rs

@@ -54,7 +54,7 @@ impl RateLimiter {
     }
 
     pub fn try_consume(&self, project_id: &str, cost: f64) -> bool {
-        let mut buckets = self.buckets.lock().unwrap();
+        let mut buckets = self.buckets.lock().unwrap_or_else(|e| e.into_inner());
 
         // Evict stale entries if at capacity
         if buckets.len() >= MAX_BUCKETS {
@@ -68,7 +68,7 @@ impl RateLimiter {
 
     #[allow(dead_code)]
     pub fn available_tokens(&self, project_id: &str) -> f64 {
-        let mut buckets = self.buckets.lock().unwrap();
+        let mut buckets = self.buckets.lock().unwrap_or_else(|e| e.into_inner());
         let bucket =
             buckets.entry(project_id.to_string()).or_insert_with(|| Bucket::new(self.max_tokens, self.refill_per_sec));
         bucket.refill();