Paul BakausandClaude Opus 4.6 b628e208e3 Harden API endpoints: input validation, error sanitization, security headers ...

- Add shared validation helper (server/lib/validation.js) with ID regex, provider/type allowlists
- Validate all route params against allowlists before filesystem operations to prevent path traversal
- Strip stack traces and error.message from production error responses (generic "Internal server error")
- Sanitize filenames in Content-Disposition headers
- Add X-Content-Type-Options: nosniff and X-Frame-Options: DENY to dev server static responses
- Add path traversal (.. ) checks to all static file handlers and catch-all fetch

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-03-05 09:58:05 -08:00

..

[id].js

Harden API endpoints: input validation, error sanitization, security headers

2026-03-05 09:58:05 -08:00