TheSunIsLeaking/recflare
3
0
Fork 0
mirror of https://github.com/djdevin/recflare.git synced 2026-09-09 15:11:29 -07:00
Code Issues Packages Projects Releases Wiki Activity

[api] audit fixes: account tests, dependencies and security hardening (#54)

Browse Source 
* test(accounts): cover three username changes

* chore(deps): update vulnerable runtime dependencies

* fix(security): bound uploads and validate token subjects strictly

---------

Co-authored-by: Nexi (CWN) <communityshieldofficial@gmail.com>
This commit is contained in:
Nexi
2026-09-09 04:47:58 +01:00
committed by GitHub
parent 9696c56317
commit 222547ee13
38 changed files with 1161 additions and 632 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/jwt/src/jwt.ts
+6 -2
View File
@@ -52,8 +52,12 @@ export async function validateAndGetAccountId(
const accountId = await getAccountIdFromToken(token, secret)
if (!accountId) return null
const id = Number.parseInt(accountId, 10)
return Number.isNaN(id) ? null : id
// `parseInt("42junk", 10)` is 42, which lets a malformed subject select a real
// account. Token subjects are canonical positive base-10 account ids: reject
// partial parses, signs, decimals, leading zeroes and values outside JS's safe range.
if (!/^[1-9]\d*$/.test(accountId)) return null
const id = Number(accountId)
return Number.isSafeInteger(id) ? id : null
}
/**