[codex] Batch E: XSS, comms & realtime hardening (round-2 audit) - #23
Merged
Conversation
- #4 (HIGH) feedback admin detail modal: every visitor-supplied field (body, page_url, element_selector, screenshot src, visitor name/email, and per-comment user_email/body/created_at) is now escH()-escaped before innerHTML, matching the list/card renderers. Closes stored XSS -> admin session takeover. - Med email: opts.From is CRLF-stripped like the other header fields (a 'send as'/reply-routing caller can't inject Bcc/extra headers). - Med XLSX: data cells run through csvSafeCell (formula-injection neutralization) before xmlEscape, matching the CSV export path. - Med WebSocket: the write-locked admission re-check now recomputes ALL THREE caps (global + per-user + per-anon-IP), not just the global ceiling, so a burst of handshakes from one user/IP can't exceed its per-class cap. - Med presence: storage keys are namespaced by the caller's tenant group (presenceKey) so a user in one group can't read/write another group's slug via GET/heartbeat - cross-tenant presence enumeration closed. No schema change. - Low SMS: recipient normalized + validated to E.164 before the rate-limit check, so format variants share one bucket and bad/premium-length numbers are rejected before billing the provider. Not changed: isPrivateURL alt-IP encodings are already fail-closed (LookupIP fails on non-dotted hosts) and Go handles IPv4-mapped IPv6; PDF --no-sandbox is environment-dependent and its error echo is dev-only. go build + vet + test -tags sqlite_fts5 ./... green; -race clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the round-2 XSS/comms/realtime findings (discussion #13).
body,page_url,element_selector,screenshotsrc, visitor name/email, per-comment fields) is nowescH()-escaped beforeinnerHTML(matching the list/card renderers). Closes stored XSS → admin session takeover.Fromis CRLF-stripped like the other header fields.csvSafeCell(formula-injection) beforexmlEscape.Not changed:
isPrivateURLalt-IP encodings are already fail-closed + Go handles IPv4-mapped IPv6; PDF--no-sandboxis env-dependent and its echo is dev-only.Tests added;
go build+vet+test -tags sqlite_fts5 ./...green;-raceclean.