4 Commits

Include renames

Author	SHA1	Message	Date
qing	e2f05f9a43	fix(libmsg): security audit round 4 - eliminate residual race + atomic server_fd ... - P1-3: introduce ConnectionLock (mutex + atomic active) to close the residual CWE-362 race where _remove_client closes fd before reply/broadcast acquires the lock; senders now check active after locking and abort if fd was closed - P2-7: make _server_fd std::atomic<int> to remove the data-race UB between stop() and _event_loop - P2-8: validate on_message is non-null in MsgServer::start() - P3-2: distinguish missing _route vs wrong-typed _route in RpcServer - P3-3: set TCP_NODELAY/SO_SNDTIMEO before registering fd in _clients - doc: add SO_SNDTIMEO precondition note to pmsg_send	2026-08-07 21:27:05 +08:00
qing	63c22a3d60	fix(libmsg): security audit round 3 - add server send timeout + harden RPC validation	2026-08-07 21:13:14 +08:00
qing	3c50a862d3	fix(libmsg): complete security audit round 2 - fix P0 race + harden input validation ... - P0: fix _close_all_clients() race condition (CWE-362) - hold per-connection send_lock before close() to prevent messages being sent to wrong client after fd reuse - P2: add comprehensive input validation for all public APIs (timeout/port/workers/max_connections/batch_size etc. bounds checking) - P2: add UTF-8 payload validation (isValidUtf8) aligning with Python pymsg behavior, rejecting overlong encodings, surrogate pairs, truncated/invalid sequences - P2: document pmsg_recv(int) precondition and recommend deadline mode - add constructor validation for MsgClient/MsgServer/AsyncQueue/RpcClient/RpcServer - add add_route() validation for empty route name and null handler - update security audit report with round 2 findings and fixes (8 issues total, 100% fixed)	2026-08-07 21:01:34 +08:00
qing	a4611ec737	docs(security): 新增 libmsg 安全审计报告，更新文档索引 ... 新增 docs/security/libmsg_SECURITY_AUDIT_20260806.md，记录 SAST 扫描发现的 3 个漏洞（CWE-362/400/209）及对应修复方案，更新 docs/INDEX.md 加入 libmsg 审计文档入口。	2026-08-06 17:18:27 +00:00