Daravelv1.0.0
ENID GitHub

Security

Report vulnerabilities privately as described in SECURITY.md.

Secure by default (BLUEPRINT_V2 §9.2)#

# Default Where
1 APP_DEBUG=true with APP_ENV=production fails at boot unless explicitly allowed ConfigValidator
2 APP_KEY must be 32 bytes; weak keys are refused Encrypter
3 CORS allows no origin until configured; * with credentials is rejected CorsMiddleware
4 Cookies: sessions arrive in Tier 2 n/a
5 nosniff, Referrer-Policy, X-Frame-Options for HTML, HSTS on HTTPS SecurityHeadersMiddleware
6 Starter throttles login (5/min per e-mail + IP) and register (5/min per IP) bootstrap/app.dart
7 Logs redact secrets and never log request bodies Logger
8 Uploads: types come from the content (never the name), PHP files are refused, bodies and file counts are limited, temporary files are removed after the response, and storage paths cannot escape the disk detectMimeType, normalizeDiskPath
9 Generic credential errors; unknown accounts still cost a hash equalizeLoginTiming
10 dartisan doctor --production fails on critical misconfiguration CLI

Other built-in controls: X-Forwarded-* ignored unless the peer is a trusted proxy; body size and JSON depth limits; header names and values with CR, LF or NUL are rejected (no response splitting); JWT verification rejects alg: none and key-type confusion; token secrets are compared in constant time; SQL is always built from bound values and quoted identifiers (daravel_lints flags string interpolation in raw SQL).

Security suite (§9.3)#

packages/daravel/test/security/ (tag security) runs on every commit:

  • OWASP SQL injection payloads as values (stored verbatim) and as identifiers (quoted, never executed);
  • X-Forwarded-* spoofing from untrusted and trusted peers;
  • declared and streamed bodies over the limit, deeply nested JSON;
  • JWT alg manipulation, Ed25519 → HS256 key confusion, tampering, expiry;
  • expired personal access tokens;
  • storage path traversal (../, absolute and Windows paths);
  • header injection through handlers;
  • ReDoS: every built-in pattern rule on adversarial 100 KB inputs must stay under 10 ms;
  • seeded property-based fuzzing of the .env, cron, cursor and JSON body parsers and of bearer-token parsing;
  • user enumeration through login timing.
cd packages/daravel && dart test --tags security