From 7999fab25c5172207ee41e38732f4923565ff6b6 Mon Sep 17 00:00:00 2001
From: Andrew Guschin <guschin@altlinux.org>
Date: Fri, 30 Oct 2026 04:43:59 +0400
Subject: Validate controller diagnostics, reboot protection, and terminal
 authentication

---
 src/diagnostics.rs | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

(limited to 'src/diagnostics.rs')

diff --git a/src/diagnostics.rs b/src/diagnostics.rs
index 432a801..f6ed82a 100644
--- a/src/diagnostics.rs
+++ b/src/diagnostics.rs
@@ -104,6 +104,10 @@ pub async fn measure(
         !content_type.contains("html"),
         "Diagnostic endpoint returned HTML"
     );
+    ensure!(
+        !content_type.contains("application/problem+"),
+        "Diagnostic endpoint returned an error document"
+    );
     let status = response.status().as_u16();
     let stream = response.bytes_stream().map_err(std::io::Error::other);
     let mut reader = tokio_util::io::StreamReader::new(stream);
@@ -154,6 +158,19 @@ pub async fn measure(
         !prefix.starts_with("<!doctype html") && !prefix.starts_with("<html"),
         "Diagnostic endpoint returned an HTML document"
     );
+    let json_error = serde_json::from_str::<serde_json::Value>(&prefix)
+        .ok()
+        .is_some_and(|body| {
+            ["error", "errors"].iter().any(|key| {
+                body.get(key).is_some_and(|value| {
+                    !value.is_null() && value != false && value != 0 && value != ""
+                })
+            })
+        });
+    ensure!(
+        !json_error,
+        "Diagnostic endpoint returned an error document"
+    );
     ensure!(!speed || bytes > 0, "Speed response contained no data");
     if !speed && settings.ping_url == Settings::default().ping_url {
         ensure!(
-- 
cgit v1.2.3