release: v0.7.2 — Security Audit Remediation (SA-01 bis SA-07)

- SA-01: Container-DoS / KDF-Amplification Schutz mit Pre-KDF Validierung, max 2 Slots (nur 0 und 1), Slot 0 Pflicht und strikten BLOB-Laengen
- SA-02: Release-Signierung in CI entkoppelt (getrennte build und sign-and-release Jobs, Secret-Isolation)
- SA-03: Pinned Download-Integritaet fuer minisign.exe in CI via SHA-256
- SA-04: Immutable Action-Pinning (@sha) und Toolchain-Pinning (1.85.0) in CI
- SA-05: Session-Token vollstaendig aus URIs verbannt (403 Forbidden bei Vorkommen im Pfad/Query)
- SA-06: Constant-Time Token- und Auth-Vergleiche via subtle::ConstantTimeEq
- SA-07: Dokumentations-Klarstellung bzgl. logischem Shredding vs. physischer SSD/FTL/CoW-Persistenz

tests/path_traversal_test.rs

@@ -27,9 +27,25 @@ fn test_validate_node_name_rejections() {
 
     // 6. Windows reservierte Gerätenamen
     let reserved_names = [
-        "CON", "con", "prn", "PRN", "aux", "AUX", "nul", "NUL",
-        "COM1", "com2", "COM9", "lpt1", "LPT2", "LPT9",
-        "con.txt", "aux.dat", "NUL.tar.gz", "com1.log", "prn.pdf",
+        "CON",
+        "con",
+        "prn",
+        "PRN",
+        "aux",
+        "AUX",
+        "nul",
+        "NUL",
+        "COM1",
+        "com2",
+        "COM9",
+        "lpt1",
+        "LPT2",
+        "LPT9",
+        "con.txt",
+        "aux.dat",
+        "NUL.tar.gz",
+        "com1.log",
+        "prn.pdf",
     ];
     for res in reserved_names {
         assert!(
@@ -64,7 +80,10 @@ fn test_validate_node_name_accepted() {
 #[test]
 fn test_storage_create_and_rename_reject_invalid_names() {
     let mut path = std::env::temp_dir();
-    path.push(format!("sanctum_test_pathutil_{}.sanctum", std::process::id()));
+    path.push(format!(
+        "sanctum_test_pathutil_{}.sanctum",
+        std::process::id()
+    ));
     if path.exists() {
         let _ = std::fs::remove_file(&path);
     }
@@ -80,20 +99,31 @@ fn test_storage_create_and_rename_reject_invalid_names() {
     let (wrapped, nonce, tag) = sanctum::crypto::wrap_dek(&kek, &dek).unwrap();
 
     let db = sanctum::storage::Database::open(&path).unwrap();
-    db.init_schema(&salt, &kdf_params, &wrapped, &nonce, &tag).unwrap();
+    db.init_schema(&salt, &kdf_params, &wrapped, &nonce, &tag)
+        .unwrap();
 
     // create_node_in_vault mit ungültigem Namen muss scheitern
     assert!(db.create_node_in_vault(0, 1, "..", false, &dek).is_err());
     assert!(db.create_node_in_vault(0, 1, "CON", false, &dek).is_err());
-    assert!(db.create_node_in_vault(0, 1, "sub/dir", false, &dek).is_err());
+    assert!(db
+        .create_node_in_vault(0, 1, "sub/dir", false, &dek)
+        .is_err());
 
     // Gültige Datei erstellen
-    let valid_node = db.create_node_in_vault(0, 1, "valid.txt", false, &dek).unwrap();
+    let valid_node = db
+        .create_node_in_vault(0, 1, "valid.txt", false, &dek)
+        .unwrap();
 
     // rename_node_in_vault mit ungültigem Namen muss scheitern
-    assert!(db.rename_node_in_vault(valid_node.id, 1, "..", 0, &dek).is_err());
-    assert!(db.rename_node_in_vault(valid_node.id, 1, "AUX", 0, &dek).is_err());
-    assert!(db.rename_node_in_vault(valid_node.id, 1, "bad\\name", 0, &dek).is_err());
+    assert!(db
+        .rename_node_in_vault(valid_node.id, 1, "..", 0, &dek)
+        .is_err());
+    assert!(db
+        .rename_node_in_vault(valid_node.id, 1, "AUX", 0, &dek)
+        .is_err());
+    assert!(db
+        .rename_node_in_vault(valid_node.id, 1, "bad\\name", 0, &dek)
+        .is_err());
 
     let _ = std::fs::remove_file(&path);
 }