viceroy

Viceroy Audit Findings

Security audit of Viceroy, the local development server for Fastly Compute. Each finding includes a detailed write-up and a patch.

Summary

Total findings: 30 -- High: 7, Medium: 23, Low: 0

Findings

Trap and error reporting

#	Finding	Severity
001	Trap details exposed in HTTP 500 body	Medium

Cache hostcalls

#	Finding	Severity
002	Duration conversion panics on oversized cache metadata	Medium
003	Age conversion panics on oversized cache metadata	Medium
004	get_body leaks a spawned stream when rejecting a second reader	Medium
006	Full-body read lacks a decoded size cap	Medium

KV and object store handles

#	Finding	Severity
008	Invalid pending-operation handles panic on await	Medium
010	Invalid store handle panics KV hostcalls	High
011	lookup_wait exposes partial state on buffer error	Medium
017	Invalid store handle panics host lookup paths	High
018	Invalid store handle panics host insert paths	High
019	Invalid store handle panics host delete path	High

Object store concurrency

#	Finding	Severity
012	Insert preconditions race concurrent writers	High
013	Append and prepend lose concurrent updates	High

HTTP and networking

#	Finding	Severity
014	Invalid pending request handle panics await_response	High
015	get_header_values panics on invalid request handle	Medium
016	Host header overrides backend authority	Medium
020	Invalid response handle traps in header value lookup	Medium
021	Remote IP lookup unwraps untrusted response handle	Medium
022	Remote port lookup unwraps untrusted response handle	Medium
023	Backend route ID accepted without backend validation	Medium

Body and streaming

#	Finding	Severity
024	Known-size tee panics on body read error	Medium

Header parsing

#	Finding	Severity
033	Missing trailing NUL drops last header value	Medium
034	Empty values buffer silently clears headers	Medium

Configuration parsing

#	Finding	Severity
026	Empty TOML client certificate chains bypass validation	Medium
028	Multiple PEM private keys are silently accepted	Medium
030	Missing env secret becomes empty bytes	Medium

Shielding

#	Finding	Severity
029	Oversized shielding backend persists after length error	Medium

Wasm module rewriting

#	Finding	Severity
039	Valid multi-memory modules panic during rewrite	Medium
040	Large memarg offset overflow panics during rewrite	Medium
041	Supported Wasm instructions hit todo panic	Medium