Leopoldadmin/leocrm
1
0
Fork 0
Code Issues 363 Pull Requests Actions 6 Packages Projects Releases 1 Wiki Activity

Security fixes: P0-P2 complete (22 fixes)

Browse Source 
P0 (7): Auth-bypass removed, migrations fixed, plugin-upload disabled, RLS FORCE+WITH CHECK, plugin double-registration fixed, persistent volume, domain removed
P1 (11): User/tenant model, Redis centralized, worker separated, transactional outbox, XSS fixed, DMS chunked streaming, permissions unified, password reset, metrics secured, config/docs fixed, cross-tenant FK
P2 (4): Contact model normalized, cross-imports reduced 94%, commands+state machines for contacts/dms/mail/calendar, SPA path-traversal

8 new migrations, 99 unit tests, 13 commands, 8 contracts, 72 files changed
This commit is contained in:
Agent Zero
2026-07-25 21:03:46 +02:00
parent aaa7406929
commit 727d86614e
103 changed files with 6831 additions and 1053 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frontend/src/components/comm/blocks/ActionCardBlock.tsx
+9 -2
View File
@@ -23,8 +23,15 @@ const ActionCardBlock: React.FC<ActionCardBlockProps> = ({ block }) => {
// Frontend handles dismiss — no-op here, parent component can wire up
return;
}
// Treat as URL
window.open(action.action, '_blank', 'noopener,noreferrer');
// Validate URL — only allow http: and https: protocols to prevent javascript: URLs
const url = action.action;
try {
const parsed = new URL(url);
if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') return;
} catch {
return; // Invalid URL
}
window.open(url, '_blank', 'noopener,noreferrer');
};
return (
frontend/src/components/comm/blocks/HtmlBlock.tsx
+2 -21
View File
@@ -1,30 +1,11 @@
import React from 'react';
import DOMPurify from 'dompurify';
import type { MessageBlock } from '@/store/commStore';
interface HtmlBlockProps {
block: MessageBlock;
}
/**
* Basic HTML sanitization: removes <script> tags and event handler attributes.
* This is a minimal sanitizer — for production use DOMPurify or similar.
*/
function sanitizeHtml(html: string): string {
let sanitized = html;
// Remove <script>...</script> blocks (including content)
sanitized = sanitized.replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '');
// Remove <script ...> self-referencing or incomplete tags
sanitized = sanitized.replace(/<script\b[^>]*>/gi, '');
// Remove on* event handler attributes (onclick, onload, onerror, etc.)
sanitized = sanitized.replace(/\son\w+\s*=\s*"[^"]*"/gi, '');
sanitized = sanitized.replace(/\son\w+\s*=\s*'[^']*'/gi, '');
sanitized = sanitized.replace(/\son\w+\s*=\s*[^\s>]+/gi, '');
// Remove javascript: URLs in href/src
sanitized = sanitized.replace(/(href|src)\s*=\s*"javascript:[^"]*"/gi, '$1="#"');
sanitized = sanitized.replace(/(href|src)\s*=\s*'javascript:[^']*'/gi, '$1="#"');
return sanitized;
}
const HtmlBlock: React.FC<HtmlBlockProps> = ({ block }) => {
const rawHtml: string = block.block_data.html || '';
@@ -32,7 +13,7 @@ const HtmlBlock: React.FC<HtmlBlockProps> = ({ block }) => {
return null;
}
const sanitized = sanitizeHtml(rawHtml);
const sanitized = DOMPurify.sanitize(rawHtml);
return (
<div