[security] apps/spinel/patches/2-tep-bakeoff.patch:152 — The five-second timeout applies separately to each socket read. A client sending another body byte every four seconds can occupy the sole worker for hours, blocking every visitor. Enforce a deadline for the entire request.
[correctness] apps/spinel/.cache/x86/tep/tep/sphttp.c:254 — The dependency’s body reader silently caps each drain at 65,535 bytes, and consume_body calls it only once. A 10,000-emoji title encodes to about 120,000 bytes; sending headers before the body causes the title to be truncated and saved with a success response. Patch the dependency to read complete bodies, support the required title length, and reject incomplete requests before mutation.
[spec] apps/spinel/app.rb:203 — Any syntactically valid 22-character cookie is accepted without checking whether the server issued it. An unknown tid=AAAAAAAAAAAAAAAAAAAAAA remains the list identifier, and separate clients supplying it share subsequent todos. Track issued tokens and replace unrecognised values with fresh random cookies.
[spec] apps/spinel/patches/2-tep-bakeoff.patch:21 — --listen accepts arbitrary addresses, including 0.0.0.0; omitting the listener also retains Tep’s wildcard-binding fallback. This violates the loopback-only requirement. Reject non-loopback addresses and require a valid socket or loopback listener.
amadan