From 83da747720ced1d711548d8179e889af13df9404 Mon Sep 17 00:00:00 2001
From: Elias Haugsbakk <elias.haugsbakk@gmail.com>
Date: Thu, 23 Jul 2026 01:09:58 +0200
Subject: ai security "improvements"

---
 .../eliashaugsbakk/clams/server/config/AppConfig.java   | 17 ++++++++++++++++-
 .../clams/server/service/AuthService.java               | 10 +++++++++-
 .../clams/server/utils/MarkdownConverter.java           |  2 +-
 3 files changed, 26 insertions(+), 3 deletions(-)

(limited to 'clams-server/src/main/java/no/eliashaugsbakk/clams/server')

diff --git a/clams-server/src/main/java/no/eliashaugsbakk/clams/server/config/AppConfig.java b/clams-server/src/main/java/no/eliashaugsbakk/clams/server/config/AppConfig.java
index ada9847..05e92d2 100644
--- a/clams-server/src/main/java/no/eliashaugsbakk/clams/server/config/AppConfig.java
+++ b/clams-server/src/main/java/no/eliashaugsbakk/clams/server/config/AppConfig.java
@@ -5,6 +5,7 @@ import java.io.IOException;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.nio.file.Paths;
+import java.nio.file.attribute.PosixFilePermissions;
 import java.security.SecureRandom;
 import java.util.Base64;
 import java.util.Properties;
@@ -36,11 +37,24 @@ public class AppConfig {
         Files.createDirectories(storageDir);
         System.out.println("Created application storage directory at: " + storageDir.toAbsolutePath());
       }
+      setOwnerOnlyPermissions(storageDir);
     } catch (IOException e) {
       System.err.println("Warning: Could not verify or create storage directory: " + e.getMessage());
     }
   }
 
+  private void setOwnerOnlyPermissions(Path path) throws IOException {
+    if (!Files.exists(path)) {
+      return;
+    }
+
+    try {
+      Files.setPosixFilePermissions(path, PosixFilePermissions.fromString("rwx------"));
+    } catch (UnsupportedOperationException e) {
+      // Ignore on non-POSIX file systems.
+    }
+  }
+
   private void generateDefaultConfig() {
     try {
       Files.createDirectories(configPath.getParent());
@@ -49,6 +63,7 @@ public class AppConfig {
       new SecureRandom().nextBytes(tokenBytes);
       String token = Base64.getUrlEncoder().withoutPadding().encodeToString(tokenBytes);
 
+      Files.createDirectories(configPath.getParent());
       try (BufferedWriter writer = Files.newBufferedWriter(configPath)) {
         writer.write(String.format("""
             storage_location=./data/
@@ -56,8 +71,8 @@ public class AppConfig {
             authorization_token=%s
             """, token));
       }
+      setOwnerOnlyPermissions(configPath);
       IO.println("Generated a default configuration file at: " + configPath);
-      IO.println("Generated authentication token: " + token);
 
     } catch (IOException e) {
       System.err.println("Could not create default config file: " + e.getMessage());
diff --git a/clams-server/src/main/java/no/eliashaugsbakk/clams/server/service/AuthService.java b/clams-server/src/main/java/no/eliashaugsbakk/clams/server/service/AuthService.java
index e52613b..cb7a9ff 100644
--- a/clams-server/src/main/java/no/eliashaugsbakk/clams/server/service/AuthService.java
+++ b/clams-server/src/main/java/no/eliashaugsbakk/clams/server/service/AuthService.java
@@ -1,5 +1,7 @@
 package no.eliashaugsbakk.clams.server.service;
 
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
 import no.eliashaugsbakk.clams.server.config.AppConfig;
 
 public class AuthService {
@@ -14,6 +16,12 @@ public class AuthService {
       return false;
     }
 
-    return incomingToken.equals(tokenHash);
+    try {
+      return MessageDigest.isEqual(
+          tokenHash.getBytes(StandardCharsets.UTF_8),
+          incomingToken.getBytes(StandardCharsets.UTF_8));
+    } catch (IllegalArgumentException e) {
+      return false;
+    }
   }
 }
diff --git a/clams-server/src/main/java/no/eliashaugsbakk/clams/server/utils/MarkdownConverter.java b/clams-server/src/main/java/no/eliashaugsbakk/clams/server/utils/MarkdownConverter.java
index a0d24c8..ef855d9 100644
--- a/clams-server/src/main/java/no/eliashaugsbakk/clams/server/utils/MarkdownConverter.java
+++ b/clams-server/src/main/java/no/eliashaugsbakk/clams/server/utils/MarkdownConverter.java
@@ -7,7 +7,7 @@ import org.commonmark.renderer.html.HtmlRenderer;
 public class MarkdownConverter {
   public static String convertToHtml(String markdown) {
     Parser parser = Parser.builder().build();
-    HtmlRenderer renderer = HtmlRenderer.builder().build();
+    HtmlRenderer renderer = HtmlRenderer.builder().escapeHtml(true).build();
 
     Node document = parser.parse(markdown);
     return renderer.render(document);
-- 
cgit v1.2.3