From 9bab93daa6b3a0fb99165a8fac9accfa3a3ccbf1 Mon Sep 17 00:00:00 2001 From: b0txec Date: Mon, 24 Aug 2026 12:15:56 +0300 Subject: [PATCH] Gate /api/show/lvgmc-forecast behind ENABLE_LVGMC_FTP_JOBS too Caught by an independent follow-up review: the FTP auth-bypass fix in 6b9c7cf only gated /api/fetch/lvgmc/stations, the one route the original security review named. This sibling route calls the same fetch.fetchFile, which opens a real, unauthenticated FTP login to LVGMC regardless of any caller-supplied filename, and was only getting the traversal fix (ValidateFileName) applied to it, not the auth-bypass fix. Traced every caller of fetch.fetchFile/fetchWeatherStations in Server.scala/Main.scala this time to confirm these are the only two HTTP-reachable call sites and both are now gated. --- src/main/scala/server/Server.scala | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/src/main/scala/server/Server.scala b/src/main/scala/server/Server.scala index bf88b9c..af4bc83 100644 --- a/src/main/scala/server/Server.scala +++ b/src/main/scala/server/Server.scala @@ -64,10 +64,18 @@ class Server(postgresService: PostgresService, dataService: DataService, fetch: } // http://0.0.0.0:8080/api/show/lvgmc-forecast/Latvija_LTV_pilsetas_tekosa_dn.csv + // Gated behind the same flag as the scheduled FTP task and + // /fetch/lvgmc/stations below: fetch.fetchFile opens a real FTP login to + // LVGMC regardless of any caller-supplied filename, so an unauthenticated + // caller could otherwise trigger unlimited outbound FTP sessions no + // matter what ENABLE_LVGMC_FTP_JOBS says. case GET -> Root / "show" / "lvgmc-forecast" / ValidateFileName(fileName) => - fetch.fetchFile(fileName).flatMap(bytes => - Ok(bytes).map(_.withContentType(`Content-Type`(MediaType.text.csv))) - ) + if (sys.env.get("ENABLE_LVGMC_FTP_JOBS").exists(_.equalsIgnoreCase("true"))) + fetch.fetchFile(fileName).flatMap(bytes => + Ok(bytes).map(_.withContentType(`Content-Type`(MediaType.text.csv))) + ) + else + ServiceUnavailable("LVGMC FTP fetching is currently disabled") // http://0.0.0.0:8080/api/fetch/lvgmc/stations // Gated behind the same flag as the scheduled FTP task: this route would