Harden API endpoints: input validation, error sanitization, security headers

- Add shared validation helper (server/lib/validation.js) with ID regex, provider/type allowlists
- Validate all route params against allowlists before filesystem operations to prevent path traversal
- Strip stack traces and error.message from production error responses (generic "Internal server error")
- Sanitize filenames in Content-Disposition headers
- Add X-Content-Type-Options: nosniff and X-Frame-Options: DENY to dev server static responses
- Add path traversal (.. ) checks to all static file handlers and catch-all fetch

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/lib/api-handlers.js

@@ -3,6 +3,7 @@ import { basename, join, dirname } from "path";
 import { existsSync } from "fs";
 import { fileURLToPath } from "url";
 import { readPatterns, parseFrontmatter } from "../../scripts/lib/utils.js";
+import { isValidId, isAllowedProvider, isAllowedType, sanitizeFilename } from "./validation.js";
 
 // Get project root directory (works in both Node.js and Bun, including Vercel)
 const __filename = fileURLToPath(import.meta.url);
@@ -47,6 +48,10 @@ export async function getCommands() {
 
 // Get command/skill source content
 export async function getCommandSource(id) {
+	if (!isValidId(id)) {
+		return { error: "Invalid command ID", status: 400 };
+	}
+
 	const skillPath = join(PROJECT_ROOT, "source", "skills", id, "SKILL.md");
 
 	try {
@@ -87,10 +92,18 @@ export function getFilePath(type, provider, id) {
 
 // Handle individual file download
 export async function handleFileDownload(type, provider, id) {
-	if (type !== "skill" && type !== "command") {
+	if (!isAllowedType(type)) {
 		return new Response("Invalid type", { status: 400 });
 	}
 
+	if (!isAllowedProvider(provider)) {
+		return new Response("Invalid provider", { status: 400 });
+	}
+
+	if (!isValidId(id)) {
+		return new Response("Invalid file ID", { status: 400 });
+	}
+
 	const filePath = getFilePath(type, provider, id);
 
 	if (!filePath) {
@@ -103,7 +116,7 @@ export async function handleFileDownload(type, provider, id) {
 		}
 
 		const content = await readFile(filePath);
-		const fileName = basename(filePath);
+		const fileName = sanitizeFilename(basename(filePath));
 		return new Response(content, {
 			headers: {
 				"Content-Type": "application/octet-stream",
@@ -128,6 +141,10 @@ export async function getPatterns() {
 
 // Handle bundle download
 export async function handleBundleDownload(provider) {
+	if (!isAllowedProvider(provider)) {
+		return new Response("Invalid provider", { status: 400 });
+	}
+
 	const distDir = join(PROJECT_ROOT, "dist");
 	const zipPath = join(distDir, `${provider}.zip`);
 
@@ -137,10 +154,11 @@ export async function handleBundleDownload(provider) {
 		}
 
 		const content = await readFile(zipPath);
+		const safeProvider = sanitizeFilename(provider);
 		return new Response(content, {
 			headers: {
 				"Content-Type": "application/zip",
-				"Content-Disposition": `attachment; filename="impeccable-style-${provider}.zip"`,
+				"Content-Disposition": `attachment; filename="impeccable-style-${safeProvider}.zip"`,
 			},
 		});
 	} catch (error) {

server/lib/validation.js

@@ -0,0 +1,24 @@
+// Shared validation helpers for input sanitization
+
+// Only allow alphanumeric, hyphens, and underscores in IDs
+export const VALID_ID = /^[a-zA-Z0-9_-]+$/;
+
+export const ALLOWED_PROVIDERS = ['cursor', 'claude-code', 'gemini', 'codex', 'agents', 'universal'];
+export const ALLOWED_TYPES = ['skill', 'command'];
+
+export function isValidId(id) {
+  return typeof id === 'string' && VALID_ID.test(id);
+}
+
+export function isAllowedProvider(provider) {
+  return ALLOWED_PROVIDERS.includes(provider);
+}
+
+export function isAllowedType(type) {
+  return ALLOWED_TYPES.includes(type);
+}
+
+// Sanitize a filename for use in Content-Disposition headers
+export function sanitizeFilename(filename) {
+  return filename.replace(/[^a-zA-Z0-9._-]/g, '');
+}