Repository navigation
fix(security): harden linking, cache purges, ingest limits and secret checks - #21
Merged
Merged
Conversation
… checks From an independent review of the deployed code: - accounts link across providers only on a provider-verified email - project actions refresh caches only when the caller's row changed - past the lookup budget, a known project keeps its last settings - pageview bodies over 8 KB are ignored before parsing - malformed site keys never reach the database or the cache - bearer secrets are compared in constant time Claude-Session: https://claude.ai/code/session_01X2rqistoob3eewaQAJVwr3
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
A separate read-only agent reviewed the deployed code for authorization, ingest abuse, XSS and secrets. It found no cross-tenant access, SQL injection, stored XSS or committed secret. These six findings were real and cheap to close.
Scope
apps/web/src/lib/auth.ts:accountLinkingno longer names trusted providers, so a link needs a provider-verified email. Before, an unverified address matching another user's could link into their account.features/projects/actions.ts:updateProject,deleteProjectandrotateApiTokencallprojectChangedonly when the owner-scoped write matched a row. Before, a signed-in user could purge any site key's caches.packages/core/src/directory.ts: past the lookup budget,ProjectDirectory.getreturns the entry it already had. Before, a flood of junk keys made known projects resolve to unknown.packages/core/src/ingest.ts:MAX_BODY_BYTES(8 KB) checked onContent-Lengthand on the text;hasBearerandsafeEqualfor constant-time secret checks, used by the Worker and/api/revalidate.features/projects/queries.ts:cachedProjectreturns null for a malformed site key without a query or a cache entry.Tradeoffs
Noted and left: a site key is public by design, so anyone can send fake pageviews for it and use up its daily cap; the project limit is check-then-insert;
docker-compose.ymlenables the demo login by default for the quickstart.Verification
pnpm verify: 31 core, 28 ingest, 22 db, 8 web, 6 tracker, 2 next tests. New tests: an oversized body is not counted; a known project still counts after 40 junk keys spend the budget;hasBearerrejects a wrong, missing or unset secret.https://claude.ai/code/session_01X2rqistoob3eewaQAJVwr3