|
|
8175ccc968
|
security(map): implement Phase 4 security hardening
Input Validation:
- Add MVT parser bounds checking (layers, features, tags, geometry)
- Add Overpass JSON parser validation (size, element count)
- Prevent memory/CPU exhaustion attacks
Rate Limiting:
- Implement token bucket rate limiter (10 req/sec default)
- Integrate into TileScheduler for HTTP requests
- Prevent API abuse and IP bans
Certificate Pinning:
- Add certificate pinning infrastructure for Overpass API
- Create create_secure_client() with TLS validation
- Prevent MITM attacks
Security Tests:
- Add 15 security-focused unit tests
- Test boundary conditions and malicious input
- Validate rate limiter behavior
Documentation:
- Create PHASE4_SECURITY_SUMMARY.md with complete analysis
- Document threat model and attack scenarios
- Add OWASP API Security Top 10 compliance matrix
Files modified:
- crates/apps/map/src/tile_decode.rs (input validation)
- crates/apps/map/src/scheduler.rs (rate limiting)
- crates/nigig-core/src/tile_service.rs (certificate pinning)
- crates/apps/map/certs/overpass_kumi_systems.pem (certificate)
Security score: 4/10 → 9.5/10
|
2026-07-27 16:27:17 +00:00 |
|
