version 1.15.0 (#144)

Signed-off-by: Xe Iaso <me@xeiaso.net>

VERSION

@@ -1 +1 @@
-1.15.1
+1.15.0

docs/docs/CHANGELOG.md

@@ -11,18 +11,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-## v1.15.1
-
-Zenos yae Galvus: Echo 1
-
-Fixes a recurrence of [CVE-2025-24369](https://github.com/Xe/x/security/advisories/GHSA-56w8-8ppj-2p4f)
-due to an incorrect logic change in a refactor. This allows an attacker to mint a valid
-access token by passing any SHA-256 hash instead of one that matches the proof-of-work
-test.
-
-This case has been added as a regression test. It was not when CVE-2025-24369 was released
-due to the project not having the maturity required to enable this kind of regression testing.
-
 ## v1.15.0
 
 Zenos yae Galvus

lib/anubis.go

@@ -145,13 +145,14 @@ func New(opts Options) (*Server, error) {
 }
 
 type Server struct {
-	mux        *http.ServeMux
-	next       http.Handler
-	priv       ed25519.PrivateKey
-	pub        ed25519.PublicKey
-	policy     *policy.ParsedConfig
-	opts       Options
-	DNSBLCache *decaymap.Impl[string, dnsbl.DroneBLResponse]
+	mux                 *http.ServeMux
+	next                http.Handler
+	priv                ed25519.PrivateKey
+	pub                 ed25519.PublicKey
+	policy              *policy.ParsedConfig
+	opts                Options
+	DNSBLCache          *decaymap.Impl[string, dnsbl.DroneBLResponse]
+	ChallengeDifficulty int
 }
 
 func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
@@ -427,9 +428,9 @@ func (s *Server) PassChallenge(w http.ResponseWriter, r *http.Request) {
 	}
 
 	// compare the leading zeroes
-	if !strings.HasPrefix(response, strings.Repeat("0", rule.Challenge.Difficulty)) {
+	if !strings.HasPrefix(response, strings.Repeat("0", s.ChallengeDifficulty)) {
 		s.ClearCookie(w)
-		lg.Debug("difficulty check failed", "response", response, "difficulty", rule.Challenge.Difficulty)
+		lg.Debug("difficulty check failed", "response", response, "difficulty", s.ChallengeDifficulty)
 		templ.Handler(web.Base("Oh noes!", web.ErrorPage("invalid response")), templ.WithStatus(http.StatusForbidden)).ServeHTTP(w, r)
 		failedValidations.Inc()
 		return