joshuaandClaude Sonnet 5
032d3c032e
Path traversal (CWE-22/CWE-73): event-image, branding (logo/favicon), and event-attachment uploads built the saved filename from the client-supplied original filename with no sanitization, and multer's diskStorage joins that straight into the destination path. A crafted filename containing `../` sequences could write the uploaded file anywhere the server process has write access — reachable by any supervisor-level account, and briefly pre-auth via the branding uploads during initial /setup. Filenames are now always server- generated (random bytes + validated extension); the original name is kept only as display metadata. Dependencies: express-rate-limit was declared only at the repo root despite being required directly by backend/src/index.js, so a plain `cd backend && npm install` (per the deployment doc) would never install it — moved it into backend/package.json. Bumped next off a version affected by a critical unauthenticated RCE (React Flight protocol) and switched it from an exact pin to a caret range so future patches install automatically. Bumped multer/nodemailer/jsonwebtoken/ uuid to patched versions, with an override forcing the vulnerable nested uuid inside exceljs and the vulnerable postcss bundled inside next to the patched versions too. `npm audit` is now clean (0 vulnerabilities) across root, backend, and frontend. Hardening: jwt.verify() now pins algorithms: ['HS256'] instead of trusting the token header; /uploads now serves with a restrictive CSP and X-Content-Type-Options: nosniff so an uploaded SVG containing <script> can't execute if opened directly. Verified: backend's Jest suite passes, the backend boots and serves real requests on the bumped deps, and `next build` compiles/type- checks cleanly on the bumped frontend deps. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CSWFWQsjTc9GyffPiXEDQT
22 lines
681 B
JSON
22 lines
681 B
JSON
{
|
|
"name": "hope-events",
|
|
"version": "1.10.0",
|
|
"main": "index.js",
|
|
"scripts": {
|
|
"dev:backend": "cd backend && npm run dev",
|
|
"dev:frontend": "cd frontend && npm run dev",
|
|
"start:backend": "cd backend && npm run start",
|
|
"start:frontend": "cd frontend && npm run start",
|
|
"start": "concurrently \"npm run start:backend\" \"npm run start:frontend\"",
|
|
"dev": "concurrently \"npm run dev:backend\" \"npm run dev:frontend\"",
|
|
"build": "cd frontend && npm run build && cd .. && cd backend && npm run prisma:generate"
|
|
},
|
|
"keywords": [],
|
|
"author": "",
|
|
"license": "ISC",
|
|
"description": "",
|
|
"devDependencies": {
|
|
"concurrently": "^9.2.1"
|
|
}
|
|
}
|