fix(cache): close threat-model audit findings — pattern length + symlink escape (Cerberus)

Two reachable findings closed via Cerberus-supervised codex audit (Mantis #923):

1. Untrusted-key DoS via Invalidate (medium):
   Invalidate accepted callback-returned glob patterns without bounds, which
   then drove keysByPattern through a full key listing. New ensureSafePattern
   enforces a 4096-byte cap before listing.
   Repro: TestCache_Invalidate_UntrustedPatternLength_Bad

2. Path traversal via symlink escape (high):
   ensureSafeKey rejects byte-pattern traversal (.., null byte, leading /,
   control chars) but did not catch runtime-state symlink-following — a
   symlinked subdirectory inside baseDir could redirect an otherwise safe
   key outside the cache root. New ensureNoSymlinkPath walks each path
   segment via os.Lstat and rejects symlink components.
   Repro: TestCache_Path_PathTraversalSymlink_Bad

Section 3 (TOCTOU on Cache.mu / Invalidate-while-OnInvalidate) is documented
in threats.md as TBD — codex budget exhausted before reaching it. Filed as a
separate follow-up ticket per scope-expansion discipline.

Verification: go vet clean; go test -race -count=1 passes (1.341s). Workspace
mode required (pre-existing task #28 forge dep break affects GOWORK=off; not
introduced by this commit).

Found-by: Cerberus (mechanism-tier audit)
Audit-by: codex (supervised by Cerberus)
Closes tasks.lthn.sh/view.php?id=923

Co-Authored-By: Codex <noreply@openai.com>
Co-Authored-By: Cerberus <cerberus@lthn.ai>
Co-Authored-By: Virgil <virgil@lethean.io>

Author: 3 people

cache.go

@@ -29,6 +29,7 @@ const DefaultTTL = 1 * time.Hour
 
 const (
 	maxCacheKeyBytes            = 4096
+	maxCachePatternBytes        = 4096
 	maxCacheNameBytes           = 255
 	maxCachedRequestURLBytes    = 8192
 	maxCachedRequestMethodBytes = 32
@@ -144,6 +145,9 @@ func (cache *Cache) Path(key string) (string, error) {
 	if path != baseDir && !core.HasPrefix(path, pathPrefix) {
 		return "", core.E("cache.Path", "invalid cache key: path traversal attempt", nil)
 	}
+	if err := ensureNoSymlinkPath(baseDir, path); err != nil {
+		return "", core.E("cache.Path", "invalid cache key: symlink escape attempt", err)
+	}
 
 	return path, nil
 }
@@ -520,6 +524,10 @@ func (cache *Cache) collectJSONKeys(prefix string) ([]string, error) {
 }
 
 func (cache *Cache) keysByPattern(pattern string) ([]string, error) {
+	if err := ensureSafePattern(pattern); err != nil {
+		return nil, err
+	}
+
 	allKeys, err := cache.listJSONKeys()
 	if err != nil {
 		return nil, err
@@ -763,6 +771,60 @@ func ensureSafeKey(key string) error {
 	return nil
 }
 
+func ensureSafePattern(pattern string) error {
+	if pattern == "" {
+		return core.E("cache.validatePattern", "invalid empty pattern", nil)
+	}
+	if len(pattern) > maxCachePatternBytes {
+		return core.E("cache.validatePattern", "invalid pattern: too long", nil)
+	}
+	if core.Contains(pattern, "\\") || hasPathDangerousBytes(pattern) {
+		return core.E("cache.validatePattern", "invalid pattern: contains control bytes", nil)
+	}
+	return nil
+}
+
+func ensureNoSymlinkPath(baseDir, path string) error {
+	if err := rejectSymlink(baseDir); err != nil {
+		return err
+	}
+
+	if path == baseDir {
+		return nil
+	}
+
+	rel := core.TrimPrefix(path, normalizePath(core.Concat(baseDir, pathSeparator())))
+	if rel == path {
+		return nil
+	}
+
+	current := baseDir
+	for _, part := range core.Split(rel, pathSeparator()) {
+		if part == "" {
+			continue
+		}
+		current = core.JoinPath(current, part)
+		if err := rejectSymlink(current); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func rejectSymlink(path string) error {
+	info, err := os.Lstat(path)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil
+		}
+		return err
+	}
+	if info.Mode()&os.ModeSymlink != 0 {
+		return core.E("cache.validatePath", "path contains symlink", nil)
+	}
+	return nil
+}
+
 func hasPathDangerousBytes(s string) bool {
 	for i := 0; i < len(s); i++ {
 		if s[i] < 0x20 || s[i] == 0x7f {

cache_test.go

@@ -273,6 +273,40 @@ func TestCache_Path_Bad(t *testing.T) {
 	}
 }
 
+func TestCache_Path_PathTraversalSymlink_Bad(t *testing.T) {
+	tmpDir := t.TempDir()
+	baseDir := core.JoinPath(tmpDir, "cache")
+	outsideDir := core.JoinPath(tmpDir, "outside")
+	linkPath := core.JoinPath(baseDir, "link")
+
+	if err := os.MkdirAll(baseDir, 0o755); err != nil {
+		t.Fatalf("MkdirAll base failed: %v", err)
+	}
+	if err := os.MkdirAll(outsideDir, 0o755); err != nil {
+		t.Fatalf("MkdirAll outside failed: %v", err)
+	}
+	if err := os.Symlink(outsideDir, linkPath); err != nil {
+		t.Skipf("symlink not supported: %v", err)
+	}
+
+	c, err := cache.New(coreio.Local, baseDir, time.Minute)
+	if err != nil {
+		t.Fatalf("New failed: %v", err)
+	}
+
+	if _, err := c.Path("link/escaped"); err == nil {
+		t.Fatal("expected Path to reject symlink traversal under baseDir")
+	}
+	if err := c.Set("link/escaped", "owned"); err == nil {
+		t.Fatal("expected Set to reject symlink traversal under baseDir")
+	}
+	if _, err := os.Stat(core.JoinPath(outsideDir, "escaped.json")); err == nil {
+		t.Fatal("expected escaped file not to be written outside baseDir")
+	} else if !os.IsNotExist(err) {
+		t.Fatalf("Stat outside file failed: %v", err)
+	}
+}
+
 func TestCache_Get_Good(t *testing.T) {
 	c, _ := newTestCache(t, "/tmp/cache", time.Minute)
 
@@ -1119,6 +1153,35 @@ func TestCache_Invalidate_Good(t *testing.T) {
 	}
 }
 
+func TestCache_Invalidate_UntrustedPatternLength_Bad(t *testing.T) {
+	c, _ := newTestCache(t, "/tmp/cache-invalidate-pattern-length", time.Minute)
+
+	if err := c.Set("dns/example.com/A", "record"); err != nil {
+		t.Fatalf("Set failed: %v", err)
+	}
+
+	c.OnInvalidate("dns.changed", func(trigger string) []string {
+		return []string{strings.Repeat("a", 4097)}
+	})
+
+	deleted, err := c.Invalidate("dns.changed")
+	if err == nil {
+		t.Fatal("expected Invalidate to reject an oversized pattern")
+	}
+	if deleted != 0 {
+		t.Fatalf("expected no deletions after rejecting oversized pattern, got %d", deleted)
+	}
+
+	var record string
+	found, err := c.Get("dns/example.com/A", &record)
+	if err != nil {
+		t.Fatalf("Get failed: %v", err)
+	}
+	if !found || record != "record" {
+		t.Fatalf("expected entry to remain, found=%v record=%q", found, record)
+	}
+}
+
 func TestCache_Invalidate_PrefixWildcardDoesNotMatchBarePrefix(t *testing.T) {
 	c, _ := newTestCache(t, "/tmp/cache-invalidate-prefix", time.Minute)
 

threats.md

@@ -0,0 +1,26 @@
+# go-cache threat-model audit
+
+Audit-by: Cerberus (via codex)
+Repo: dappco.re/go/cache
+Date: 2026-04-25
+
+## 1. Untrusted-key DoS
+**Question:** Does every public method (Set, Get, Delete, SetWithTTL, SetBinary, SetBinaryWithTTL, GetBinary, DeleteMany, Clear, ClearScope, Path, Scoped, OnInvalidate, Invalidate) reach `ensureSafeKey` before touching the filesystem? Are there backstops on key length, ScopedCache prefix escape, glob-pattern blowup?
+**Finding:** YES - cache keys are bounded and public key-taking methods route through `Path`/`entryPaths` before filesystem access, and scoped prefixes are hashed plus revalidated. However, `Invalidate` accepted callback-returned glob patterns without a length backstop before `keysByPattern` listed and matched all cache keys.
+**Severity:** medium
+**Repro test:** TestCache_Invalidate_UntrustedPatternLength_Bad
+**Fix:** validate invalidation patterns with a fixed byte limit before listing cache entries.
+
+## 2. Path traversal
+**Question:** What bytes does `hasPathDangerousBytes` cover (null byte, .., leading / or ~, control chars, URL-encoded %2e%2e)? Does symlink-following escape baseDir? Is `ensureSafeResponseBodyPath` rigour applied to JSON entry paths too?
+**Finding:** YES - `ensureSafeKey` rejects empty keys, `..` segments, leading `/` via empty segments, backslashes, null/control bytes, and overlong keys; URL-encoded `%2e%2e` remains a literal safe filename segment. `ensureSafeResponseBodyPath` is applied to cached HTTP response metadata on read and write. The gap was local symlink following: a symlinked directory or file already under `baseDir` could redirect an otherwise safe key outside the cache root.
+**Severity:** high
+**Repro test:** TestCache_Path_PathTraversalSymlink_Bad
+**Fix:** reject existing symlink components from the cache root through the resolved cache path before returning paths for filesystem use.
+
+## 3. Eviction / TOCTOU
+**Question:** Is `Cache.mu` (RWMutex) discipline correct? Does `Invalidate` walk the `invalidation` map race-cleanly while `OnInvalidate` may register more? On TTL expiry, do concurrent readers race?
+**Finding:** TBD
+**Severity:** TBD
+**Repro test:** TBD
+**Fix:** TBD