Skip to content

Commit 3cb3944

Browse files
boreqboreq
committed
Add CVEs
1 parent 7b6ef7e commit 3cb3944

File tree

7 files changed

+232
-139
lines changed

7 files changed

+232
-139
lines changed

‎moooodotfarm-backend/src/ports/http/mod.rs‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,7 @@ where
5454
.route("/", get(handle_get_index::<D>))
5555
.route("/rfc", get(handle_get_rfc))
5656
.route("/new", get(handle_get_new))
57+
.route("/cves", get(handle_get_cves))
5758
.route("/metrics", get(handle_get_metrics::<D>))
5859
.route("/api/herd", get(handle_get_herd::<D>))
5960
.fallback(handle_static)
@@ -92,6 +93,11 @@ async fn handle_get_new() -> std::result::Result<Html<String>, AppError> {
9293
Ok(Html(template.render()?))
9394
}
9495

96+
async fn handle_get_cves() -> std::result::Result<Html<String>, AppError> {
97+
let template = CvesTemplate {};
98+
Ok(Html(template.render()?))
99+
}
100+
95101
async fn handle_static(uri: axum::http::Uri) -> impl IntoResponse {
96102
let path = uri.path().trim_start_matches('/');
97103

@@ -187,6 +193,10 @@ struct RfcTemplate {}
187193
#[template(path = "new.html")]
188194
struct NewTemplate {}
189195

196+
#[derive(Template)]
197+
#[template(path = "cves.html")]
198+
struct CvesTemplate {}
199+
190200
struct TemplateCowName {
191201
name: String,
192202
kind: TemplateCowNameKind,

‎moooodotfarm-backend/src/ports/http/templates/base.html‎

Lines changed: 76 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,30 @@
5656
pointer-events: none;
5757
}
5858

59+
pre {
60+
background: rgba(93, 64, 55, 0.05);
61+
padding: 1rem;
62+
border-radius: 8px;
63+
overflow-x: auto;
64+
border: 1px solid var(--grass-light);
65+
z-index: 0;
66+
text-transform: none;
67+
}
68+
69+
pre code {
70+
background: transparent;
71+
padding: 0;
72+
}
73+
74+
code {
75+
background: rgba(161, 136, 127, 0.1);
76+
padding: 0.2rem 0.4rem;
77+
border-radius: 4px;
78+
font-family: monospace;
79+
font-size: 0.95em;
80+
color: var(--grass-dark);
81+
}
82+
5983
.back-link-container {
6084
text-align: center;
6185
margin-bottom: 1.5rem;
@@ -81,27 +105,63 @@
81105
color: white;
82106
}
83107

84-
pre {
85-
background: rgba(93, 64, 55, 0.05);
86-
padding: 1rem;
87-
border-radius: 8px;
88-
overflow-x: auto;
89-
border: 1px solid var(--grass-light);
108+
.subpage-header {
109+
.cow {
110+
text-align: center;
111+
margin: 1rem 0;
112+
}
113+
114+
.cow img {
115+
width: 120px;
116+
height: auto;
117+
image-rendering: pixelated;
118+
}
119+
120+
h1 {
121+
text-align: center;
122+
font-size: 2rem;
123+
font-weight: 700;
124+
color: var(--text);
125+
margin-bottom: 0.8rem;
126+
}
127+
128+
.subtitle {
129+
text-align: center;
130+
font-size: 1.2rem;
131+
color: var(--warm-brown);
132+
margin-bottom: 1.8rem;
133+
font-weight: 700;
134+
}
135+
}
136+
137+
.content {
138+
max-width: 760px;
139+
margin: 0 auto;
140+
padding: 2rem 1.5rem 4rem;
141+
position: relative;
142+
}
143+
144+
section {
145+
border: 3px solid var(--grass);
146+
background: white;
147+
border-radius: 16px;
148+
padding: 1.5rem 1.8rem;
149+
margin: 1.6rem 0;
150+
box-shadow: 0 4px 12px rgba(93, 64, 55, 0.08);
90151
z-index: 0;
91-
text-transform: none;
92152
}
93153

94-
pre code {
95-
background: transparent;
96-
padding: 0;
154+
p {
155+
margin: 0.8rem 0;
156+
line-height: 1.6;
97157
}
98158

99-
code {
100-
background: rgba(161, 136, 127, 0.1);
101-
padding: 0.2rem 0.4rem;
102-
border-radius: 4px;
103-
font-family: monospace;
104-
font-size: 0.95em;
159+
a {
160+
color: var(--grass);
161+
text-decoration: underline;
162+
}
163+
164+
a:hover {
105165
color: var(--grass-dark);
106166
}
107167

‎moooodotfarm-backend/src/ports/http/templates/common.html‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{% macro common_header(title, subtitle_text) %}
2+
<header class="subpage-header">
3+
<div class="back-link-container">
4+
<a href="/" class="back-link">← go back to admiring all cows</a>
5+
</div>
6+
<div class="cow">
7+
<img src="/cow.png" alt="a very round cow">
8+
</div>
9+
<h1>{{ title }}</h1>
10+
<div class="subtitle">{{ subtitle_text }}</div>
11+
</header>
12+
{% endmacro %}

‎moooodotfarm-backend/src/ports/http/templates/cves.html‎

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
{% extends "base.html" %}
2+
3+
{% import "common.html" as common %}
4+
5+
{% block title %}Cow Vulnerabilities and Exposures (CVEs){% endblock %}
6+
7+
{% block extra_styles %}
8+
.cve-header {
9+
display: flex;
10+
flex-wrap: wrap;
11+
align-items: baseline;
12+
gap: 1.2em;
13+
margin-bottom: 0.7em;
14+
}
15+
.cve-id {
16+
font-size: 1.5rem;
17+
font-weight: bold;
18+
color: var(--grass-dark);
19+
letter-spacing: 0.04em;
20+
}
21+
.cve-date {
22+
color: #888;
23+
font-size: 0.98em;
24+
}
25+
.cve-title {
26+
font-size: 1.5rem;
27+
font-weight: 700;
28+
margin: 0.5rem 0 1rem 0;
29+
color: var(--warm-brown);
30+
}
31+
.cve-section {
32+
margin: 1.2em 0 0.7em 0;
33+
}
34+
.cve-section-title {
35+
font-weight: 600;
36+
color: var(--grass-dark);
37+
margin-bottom: 0.2em;
38+
font-size: 1.08em;
39+
}
40+
41+
.cve-severity, .cve-status {
42+
font-weight: bold;
43+
border-radius: 6px;
44+
padding: 0.2em 0.5em;
45+
margin-left: .2em;
46+
}
47+
48+
.cve-severity {
49+
color: #b71c1c;
50+
background: #ffeaea;
51+
}
52+
53+
.cve-status {
54+
color: var(--grass-dark);
55+
background: var(--grass-light);
56+
}
57+
{% endblock %}
58+
59+
{% block content %}
60+
<main class="content">
61+
{{ common::common_header("Cow Vulnerabilities and Exposures (CVEs)", "Security incidents affecting the herd") }}
62+
63+
<section>
64+
<div class="cve-header">
65+
<span class="cve-id">CVE-2026-1</span>
66+
<span class="cve-date">2026-02-10</span>
67+
<span class="cve-severity">Severity: HIGH</span>
68+
<span class="cve-status">Status: PATCHED</span>
69+
</div>
70+
<div class="cve-title">Side Channel Attack on Shy Cows' Censored Names</div>
71+
<div class="cve-section">
72+
<div class="cve-section-title">Description</div>
73+
<p>
74+
A side channel vulnerability in the handling of shy cows' names allowed an attacker to deduce the shy cow's name by submitting crafted names and analyzing the position of the shy cow in the herd. By observing how the position of a newly submitted cow related to other cows in the herd, the attacker could perform a binary search to reveal censored names of shy cows. This could violate the privacy expectations of shy cows in the herd.
75+
</p>
76+
</div>
77+
<div class="cve-section">
78+
<div class="cve-section-title">Severity & Impact</div>
79+
<p>
80+
Successful exploitation could result in the exposure of shy cows' names that were intended to remain private. No data corruption or denial of service is possible via this vector, but the privacy of the herd is at risk.
81+
</p>
82+
</div>
83+
<div class="cve-section">
84+
<div class="cve-section-title">Affected Versions</div>
85+
<p>
86+
All versions before the fix commit and after the cow characters were introduced.
87+
</p>
88+
</div>
89+
<div class="cve-section">
90+
<div class="cve-section-title">Patched Version</div>
91+
<p>
92+
Patched in commit <a href="https://github.com/FREESIDE-HOLDINGS-LTD/moooodotfarm/commit/c23046b80b14eca192e1574b7a97fd2934208e2b"><code>c23046b80b14eca192e1574b7a97fd2934208e2b</code></a>.
93+
</p>
94+
</div>
95+
<div class="cve-section">
96+
<div class="cve-section-title">Mitigation</div>
97+
<p>
98+
The patch ensures that the sorting logic no longer leaks information about the shy cows' names via the cows' position in the list, making such side channel attacks infeasible. No action is required for existing cows or new cows.
99+
</p>
100+
</div>
101+
<div class="cve-section">
102+
<div class="cve-section-title">Exploitation Status</div>
103+
<p>
104+
As of the date of this advisory, there is no evidence that this vulnerability was ever exploited in the wild or at the farm. The issue was discovered internally during a routine code review and has only theoretical impact. No user-reported incidents or suspicious activity related to this vulnerability have been observed.
105+
</p>
106+
</div>
107+
</section>
108+
</main>
109+
{% endblock %}

‎moooodotfarm-backend/src/ports/http/templates/index.html‎

Lines changed: 1 addition & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -61,13 +61,6 @@
6161
}
6262
}
6363

64-
.main-content {
65-
max-width: 700px;
66-
margin: 0 auto;
67-
padding: 2rem 1.5rem 4rem;
68-
position: relative;
69-
}
70-
7164
.herd-subtitle {
7265
font-size: 1.5rem;
7366
font-weight: 700;
@@ -230,7 +223,7 @@
230223
</ul>
231224
</header>
232225

233-
<main class="main-content">
226+
<main class="content">
234227
<p class="herd-subtitle">all known cow.txt files and their status</p>
235228

236229
<div class="legend">

0 commit comments

Comments
 (0)