Security fixes: P0-P2 complete (22 fixes)
P0 (7): Auth-bypass removed, migrations fixed, plugin-upload disabled, RLS FORCE+WITH CHECK, plugin double-registration fixed, persistent volume, domain removed P1 (11): User/tenant model, Redis centralized, worker separated, transactional outbox, XSS fixed, DMS chunked streaming, permissions unified, password reset, metrics secured, config/docs fixed, cross-tenant FK P2 (4): Contact model normalized, cross-imports reduced 94%, commands+state machines for contacts/dms/mail/calendar, SPA path-traversal 8 new migrations, 99 unit tests, 13 commands, 8 contracts, 72 files changed
This commit is contained in:
Agent Zero
Generated
+20
-1
@@ -25,9 +25,11 @@
|
||||
"@tiptap/pm": "^3.28.0",
|
||||
"@tiptap/react": "^3.28.0",
|
||||
"@tiptap/starter-kit": "^3.28.0",
|
||||
"@types/dompurify": "^3.2.0",
|
||||
"axios": "^1.7.7",
|
||||
"clsx": "^2.1.1",
|
||||
"date-fns": "^4.4.0",
|
||||
"dompurify": "^3.4.12",
|
||||
"i18next": "^23.14.0",
|
||||
"i18next-browser-languagedetector": "^8.0.0",
|
||||
"lucide-react": "^1.25.0",
|
||||
@@ -3485,6 +3487,15 @@
|
||||
"@types/ms": "*"
|
||||
}
|
||||
},
|
||||
"node_modules/@types/dompurify": {
|
||||
"version": "3.2.0",
|
||||
"resolved": "https://registry.npmjs.org/@types/dompurify/-/dompurify-3.2.0.tgz",
|
||||
"integrity": "sha512-Fgg31wv9QbLDA0SpTOXO3MaxySc4DKGLi8sna4/Utjo4r3ZRPdCt4UQee8BWr+Q5z21yifghREPJGYaEOEIACg==",
|
||||
"deprecated": "This is a stub types definition. dompurify provides its own type definitions, so you do not need this installed.",
|
||||
"dependencies": {
|
||||
"dompurify": "*"
|
||||
}
|
||||
},
|
||||
"node_modules/@types/estree": {
|
||||
"version": "1.0.9",
|
||||
"resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.9.tgz",
|
||||
@@ -3551,7 +3562,7 @@
|
||||
"version": "2.0.7",
|
||||
"resolved": "https://registry.npmjs.org/@types/trusted-types/-/trusted-types-2.0.7.tgz",
|
||||
"integrity": "sha512-ScaPdn1dQczgbl0QFTeTOmVHFULt394XJgOQNoyVhZ6r2vLnMLJfBPd53SB52T/3G36VI1/g2MZaX0cwDuXsfw==",
|
||||
"dev": true
|
||||
"devOptional": true
|
||||
},
|
||||
"node_modules/@types/unist": {
|
||||
"version": "3.0.3",
|
||||
@@ -4733,6 +4744,14 @@
|
||||
"dev": true,
|
||||
"peer": true
|
||||
},
|
||||
"node_modules/dompurify": {
|
||||
"version": "3.4.12",
|
||||
"resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.12.tgz",
|
||||
"integrity": "sha512-zQvGet8Z2sWbQhCmfFz/T5QWH2oBmjnqK3qvOjaqaNLrLEF912WamU+ohnTp0TCep/MFVHpdJuCZEdFOdTnEFg==",
|
||||
"optionalDependencies": {
|
||||
"@types/trusted-types": "^2.0.7"
|
||||
}
|
||||
},
|
||||
"node_modules/dunder-proto": {
|
||||
"version": "1.0.1",
|
||||
"resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
|
||||
|
||||
@@ -32,9 +32,11 @@
|
||||
"@tiptap/pm": "^3.28.0",
|
||||
"@tiptap/react": "^3.28.0",
|
||||
"@tiptap/starter-kit": "^3.28.0",
|
||||
"@types/dompurify": "^3.2.0",
|
||||
"axios": "^1.7.7",
|
||||
"clsx": "^2.1.1",
|
||||
"date-fns": "^4.4.0",
|
||||
"dompurify": "^3.4.12",
|
||||
"i18next": "^23.14.0",
|
||||
"i18next-browser-languagedetector": "^8.0.0",
|
||||
"lucide-react": "^1.25.0",
|
||||
|
||||
@@ -36,7 +36,7 @@ export interface UnifiedContact {
|
||||
name?: string | null;
|
||||
firstname?: string | null;
|
||||
surname?: string | null;
|
||||
surfix?: string | null;
|
||||
suffix?: string | null;
|
||||
ext_name_line?: string | null;
|
||||
gender?: string | null;
|
||||
code?: string | null;
|
||||
|
||||
@@ -23,8 +23,15 @@ const ActionCardBlock: React.FC<ActionCardBlockProps> = ({ block }) => {
|
||||
// Frontend handles dismiss — no-op here, parent component can wire up
|
||||
return;
|
||||
}
|
||||
// Treat as URL
|
||||
window.open(action.action, '_blank', 'noopener,noreferrer');
|
||||
// Validate URL — only allow http: and https: protocols to prevent javascript: URLs
|
||||
const url = action.action;
|
||||
try {
|
||||
const parsed = new URL(url);
|
||||
if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') return;
|
||||
} catch {
|
||||
return; // Invalid URL
|
||||
}
|
||||
window.open(url, '_blank', 'noopener,noreferrer');
|
||||
};
|
||||
|
||||
return (
|
||||
|
||||
@@ -1,30 +1,11 @@
|
||||
import React from 'react';
|
||||
import DOMPurify from 'dompurify';
|
||||
import type { MessageBlock } from '@/store/commStore';
|
||||
|
||||
interface HtmlBlockProps {
|
||||
block: MessageBlock;
|
||||
}
|
||||
|
||||
/**
|
||||
* Basic HTML sanitization: removes <script> tags and event handler attributes.
|
||||
* This is a minimal sanitizer — for production use DOMPurify or similar.
|
||||
*/
|
||||
function sanitizeHtml(html: string): string {
|
||||
let sanitized = html;
|
||||
// Remove <script>...</script> blocks (including content)
|
||||
sanitized = sanitized.replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '');
|
||||
// Remove <script ...> self-referencing or incomplete tags
|
||||
sanitized = sanitized.replace(/<script\b[^>]*>/gi, '');
|
||||
// Remove on* event handler attributes (onclick, onload, onerror, etc.)
|
||||
sanitized = sanitized.replace(/\son\w+\s*=\s*"[^"]*"/gi, '');
|
||||
sanitized = sanitized.replace(/\son\w+\s*=\s*'[^']*'/gi, '');
|
||||
sanitized = sanitized.replace(/\son\w+\s*=\s*[^\s>]+/gi, '');
|
||||
// Remove javascript: URLs in href/src
|
||||
sanitized = sanitized.replace(/(href|src)\s*=\s*"javascript:[^"]*"/gi, '$1="#"');
|
||||
sanitized = sanitized.replace(/(href|src)\s*=\s*'javascript:[^']*'/gi, '$1="#"');
|
||||
return sanitized;
|
||||
}
|
||||
|
||||
const HtmlBlock: React.FC<HtmlBlockProps> = ({ block }) => {
|
||||
const rawHtml: string = block.block_data.html || '';
|
||||
|
||||
@@ -32,7 +13,7 @@ const HtmlBlock: React.FC<HtmlBlockProps> = ({ block }) => {
|
||||
return null;
|
||||
}
|
||||
|
||||
const sanitized = sanitizeHtml(rawHtml);
|
||||
const sanitized = DOMPurify.sanitize(rawHtml);
|
||||
|
||||
return (
|
||||
<div
|
||||
|
||||
@@ -3,6 +3,7 @@
|
||||
* Supports placeholder variables for user/tenant data.
|
||||
*/
|
||||
|
||||
import DOMPurify from 'dompurify';
|
||||
import React, { useState, useEffect, useCallback } from 'react';
|
||||
import { useTranslation } from 'react-i18next';
|
||||
import { useForm } from 'react-hook-form';
|
||||
@@ -198,7 +199,7 @@ export function SignatureManager() {
|
||||
<div className="flex-1">
|
||||
<p className="font-medium text-secondary-900">{sig.name}</p>
|
||||
{sig.is_default && <span className="text-xs text-primary-600">{t('mail.defaultSignature')}</span>}
|
||||
<p className="text-sm text-secondary-500 mt-1 truncate" dangerouslySetInnerHTML={{ __html: sig.body_html }} />
|
||||
<p className="text-sm text-secondary-500 mt-1 truncate" dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(sig.body_html) }} />
|
||||
</div>
|
||||
<div className="flex gap-2">
|
||||
<Button variant="ghost" size="sm" onClick={() => handleEdit(sig)} data-testid={`edit-signature-${sig.id}`}>{t('common.edit')}</Button>
|
||||
|
||||
Reference in New Issue
Block a user