QA & Security Audit
wtb.land

Impact. A malicious page visited by an authenticated buyer can submit offers, edit/delete their requests, toggle favourites, post chat messages or mutate profile PII with no interaction. Combined with the persistent 30-day sliding cookie, the attack window is effectively permanent until manual logout.

$ grep -rn "AddAntiforgery\|ValidateAntiForgeryToken\|@Html.AntiForgeryToken" .
# (no matches)

$ curl -s -X POST "https://wtb.land/Home/Login" \
    -d "email=test@example.com&password=wrongpassword" -w "HTTP %{http_code}\n"
HTTP 200

options.Cookie.SameSite = SameSiteMode.Lax;
options.Cookie.SecurePolicy = CookieSecurePolicy.SameAsRequest;

// Program.cs - add before app.Build()
builder.Services.AddAntiforgery(o =>
{
    o.Cookie.Name = "__Host-wtb-csrf";
    o.Cookie.SameSite = SameSiteMode.Strict;
    o.Cookie.SecurePolicy = CookieSecurePolicy.Always;
    o.HeaderName = "X-CSRF-Token";
});

// After UseAuthorization()
app.UseAntiforgery();

Impact (amplification layers). (1) Credential stuffing via unthrottled 50+ logins/sec. (2) CPU exhaustion via BCrypt cost 12 (~250 ms/verify) saturating all 4 vCPUs. (3) OG-image CPU DoS (~140 ms SkiaSharp render per request). (4) Registration spam: no captcha, no email verification, no throttle.

$ for i in $(seq 1 50); do echo $i; done \
    | xargs -P 10 -I{} curl -s -o /dev/null -w "%{http_code}\n" \
        -X POST "https://wtb.land/Home/Login" \
        -d "email=test@x.com&password=wrongwrong" \
    | sort | uniq -c
     50 200     # zero throttling

$ for i in $(seq 1 100); do echo $i; done \
    | xargs -P 20 -I{} curl -s -o /dev/null -w "%{http_code}\n" \
        "https://wtb.land/?r={}" \
    | sort | uniq -c
    100 200

builder.Services.AddRateLimiter(o =>
{
    o.AddFixedWindowLimiter("auth", opt => {
        opt.PermitLimit = 5;
        opt.Window = TimeSpan.FromMinutes(1);
        opt.QueueLimit = 0;
    });
    o.AddSlidingWindowLimiter("public", opt => {
        opt.PermitLimit = 120;
        opt.Window = TimeSpan.FromMinutes(1);
        opt.SegmentsPerWindow = 6;
    });
    o.AddConcurrencyLimiter("og", opt => { opt.PermitLimit = 4; opt.QueueLimit = 8; });
    o.RejectionStatusCode = 429;
});
app.UseRateLimiter();

Impact. Any future XSS (a forgotten escape, a Razor @Html.Raw slip, a third-party dependency compromise) yields full session theft immediately. CSP is the defense of last resort; it should be configured before the bug that needs it.

$ curl -sI https://wtb.land/ | grep -i content-security
# (empty)

wtb.land {
    header {
        Content-Security-Policy "default-src 'self'; img-src 'self' data: https:; font-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' https://www.googletagmanager.com 'unsafe-inline'; connect-src 'self' https://www.google-analytics.com; frame-ancestors 'self'; base-uri 'self'; form-action 'self'; object-src 'none'"
        # also strip the Kestrel leak:
        -Server
    }
    reverse_proxy localhost:5400
}

Impact. Combined with WTBL-002, enables scoped credential stuffing against the real user population. Also leaks the admin email pattern.

$ curl -s -X POST "https://wtb.land/Home/Login" \
    -d "email=nonexistent-xyz@test.invalid&password=x" \
    -o /tmp/r1 -w "len=%{size_download}\n"
len=8263

$ curl -s -X POST "https://wtb.land/Home/Login" \
    -d "email=admin@wtb.land&password=x" \
    -o /tmp/r2 -w "len=%{size_download}\n"
len=8249

$ diff /tmp/r1 /tmp/r2
<  <input type="email" name="email" value="nonexistent-xyz@test.invalid" ...
>  <input type="email" name="email" value="admin@wtb.land" ...

if (user == null || string.IsNullOrEmpty(user.PasswordHash)
    || !BCrypt.Net.BCrypt.Verify(password, user.PasswordHash))
{
    ViewData["Error"] = "Invalid email or password";
    // DO NOT: ViewData["Email"] = email;
    return View("Login");
}

Impact. Latency growth becomes linear in pageSize. Browse page will break first - it's the single highest-volume public endpoint. Today DB = 350 requests / 223 offers / 85 users (invisible at p99 ~70 ms). Project to 100k requests and pageSize 100 -> 201 SQLite round-trips per page, serialized on the same writer-locking connection.

// WtblandGrpcService.cs:518
private async Task<WtbRequestInfo> MapRequestFromEntity(WtbRequest r, int? currentUserId)
{
    var offerCount = await _db.Offers.CountAsync(o => o.RequestId == r.Id);    // +1 query
    var isFav = currentUserId.HasValue
        && await _db.Favorites.AnyAsync(f => f.UserId == ... && f.RequestId == r.Id); // +1 query
    ...
}

// Collect IDs once, aggregate in two queries, project.
var ids = items.Select(r => r.Id).ToList();
var offerCounts = await _db.Offers
    .Where(o => ids.Contains(o.RequestId))
    .GroupBy(o => o.RequestId)
    .Select(g => new { g.Key, Count = g.Count() })
    .ToDictionaryAsync(x => x.Key, x => x.Count);
var favSet = userId.HasValue
    ? (await _db.Favorites
        .Where(f => f.UserId == userId.Value && ids.Contains(f.RequestId))
        .Select(f => f.RequestId).ToListAsync()).ToHashSet()
    : new HashSet<int>();

foreach (var item in items)
    resp.Requests.Add(MapFromEntity(item, offerCounts.GetValueOrDefault(item.Id),
                                     favSet.Contains(item.Id)));

Impact. ~7 rps of unthrottled OG requests saturate a 4-core host. Easy to trigger via social-media unfurlers or a malicious crawler.

$ for i in 1 2 3; do
    curl -s -o /dev/null -w "Total: %{time_total}s\n" \
      "https://wtb.land/og/request/1.png?nocache=$i"
  done
Total: 0.124872s
Total: 0.148446s
Total: 0.139390s

$ curl -sI https://wtb.land/og/request/1.png | grep -i cache
# (no cache-control header returned)

Impact. Good news: for jpg/png, ImageSharp's Image.LoadAsync validates + re-encodes to WebP (safe). The .webp path is the hole. nosniff blocks XSS via this route; residual risks are (a) phishing payloads served from the official domain, (b) storage abuse (no total-size-per-user cap), (c) the catch fallback (UploadController.cs:57-65) saves the original extension from a user-controlled filename.

// UploadController.cs:25-27
var ext = Path.GetExtension(file.FileName);
if (!AllowedExtensions.Contains(ext))
    return BadRequest(new { error = "Only jpg, png, webp allowed" });

if (ext.Equals(".webp", ...)) {
    var fileName = $"{guid}.webp";
    var filePath = Path.Combine(uploadsDir, fileName);
    using var stream = new FileStream(filePath, FileMode.Create);
    await file.CopyToAsync(stream);  // raw copy, no re-encode
    return Ok(new { fileName = $"/uploads/{fileName}" });
}

// Validate magic bytes instead of trusting filename
using var ms = new MemoryStream();
await file.CopyToAsync(ms);
ms.Position = 0;
IImageFormat? format;
try { format = await Image.DetectFormatAsync(ms); }
catch { return BadRequest(new { error = "Unreadable image" }); }
if (format is not (JpegFormat or PngFormat or WebpFormat))
    return BadRequest(new { error = "Unsupported format" });

ms.Position = 0;
using var image = await Image.LoadAsync(ms);
// Always re-encode to WebP - never persist client bytes as-is:
using var fs = new FileStream(webpPath, FileMode.Create);
await image.SaveAsync(fs, new WebpEncoder { Quality = 80 });

Impact. Data drift (undercounts), amplified DB I/O from anonymous traffic, and the SEO ranking signal (sort=popular) is attacker-poisonable - no unique-viewer dedup.

r.ViewCount++;
await _db.SaveChangesAsync();

// Atomic increment - avoids read-modify-write entirely
await _db.Requests
    .Where(x => x.Id == id)
    .ExecuteUpdateAsync(s => s.SetProperty(x => x.ViewCount, x => x.ViewCount + 1));

Impact. Minor reconnaissance aid - tells an attacker to target .NET/Kestrel-specific CVEs.

$ curl -sI https://wtb.land/ | grep -i server
server: Kestrel

public async Task<IActionResult> Logout() with no [HttpPost] - any external page can force-sign-out a user via <img src="https://wtb.land/Home/Logout">. Annoyance, not a security breach. Fix: [HttpPost] + [ValidateAntiForgeryToken], update the logout link in the SPA to a form submit.

if (password.Length < 6) - accepts 123456, qwerty, letmein. No HaveIBeenPwned check, no entropy floor. Fix: enforce 10-char minimum, reject passwords below the HIBP k-anonymity top-10k, add a HIBP lookup on registration + password change (free API, no key required).

RegisterPost signs the user in immediately with SignInUser(user) at line 1332 without any email ownership proof. Anyone can register someoneelses@realcompany.com and abuse the chat/offer system under that identity. Fix: add an EmailVerifiedAt column; send verification token via MailKit/SendGrid; restrict offer/message creation until verified.

AddGrpc() at Program.cs:48 uses defaults (~4 MB max inbound, OK). But GetConversations (WtblandGrpcService.cs:461-491) loads every chat message for the user into memory with three Include chains before grouping in C# - any user with >50k historical messages will OOM-pin the worker. GetMyRequests has no pagination either. Today this is fine (max 6 chat messages in DB), but the code path is a time-bomb that activates at product-market fit.

Fix. Force pagination on GetMyRequests and GetConversations (default pageSize 50, max 100). Do the grouping in SQL via LINQ GroupBy on a window query, not in LINQ-to-Objects.

robots.txt explicitly allows GPTBot, ClaudeBot, CCBot, Bytespider, PerplexityBot, Diffbot, Meta-ExternalAgent, Omgilibot and 8 others. No Crawl-delay, no per-agent Disallow: /request/ gating.

Impact. Aggregate crawling from large-model pre-training bots generates steady traffic against the unthrottled SSR renderer and the view-count write path (WTBL-008). Quiet operational cost. Fix: Crawl-delay: 10 per agent, or block the most abusive (CCBot, Bytespider) and add a noai/noimageai meta tag for consent signalling.

curl -sI https://wtb.land/wtbland.proto -> 200, 5160 bytes. By design - the vanilla-JS SPA loads the proto client-side via protobuf.js. Gives an attacker a free RPC map (method names, message shapes, optional/required fields) - saves 10 minutes of reverse engineering from the minified app.js. Neutral informational finding. Fix (optional): ship a code-generated JS stub so the field names don't leak. Cosmetic only.

Critical CSS is inlined at lines 115-123; the Google-Analytics lazy-loader is inlined at line 130. Both make a strict CSP impossible without nonces or hashes. Fix: move the GA bootstrap to a separate /js/ga-lazy.js, and emit a per-request nonce for the critical-CSS block. Razor pattern: @{ var nonce = Guid.NewGuid().ToString("N"); } -> <style nonce="@nonce"> + CSP style-src 'self' 'nonce-@nonce'.

The primary logo variants already use WebP (logo-sm.webp, logo-md.webp, etc.) but the OG fallback and the JSON-LD Organization logo still reference /img/logo.png. Social unfurlers prefer PNG here for historical reasons, so this is not a bug - flagged as Info for completeness.