mirror of
https://github.com/pbakaus/impeccable.git
synced 2026-09-11 21:57:14 +03:00
Paul BakausandClaude Opus 4.6
b628e208e3
- Add shared validation helper (server/lib/validation.js) with ID regex, provider/type allowlists - Validate all route params against allowlists before filesystem operations to prevent path traversal - Strip stack traces and error.message from production error responses (generic "Internal server error") - Sanitize filenames in Content-Disposition headers - Add X-Content-Type-Options: nosniff and X-Frame-Options: DENY to dev server static responses - Add path traversal (.. ) checks to all static file handlers and catch-all fetch Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
25 lines
737 B
JavaScript
25 lines
737 B
JavaScript
// Shared validation helpers for input sanitization
|
|
|
|
// Only allow alphanumeric, hyphens, and underscores in IDs
|
|
export const VALID_ID = /^[a-zA-Z0-9_-]+$/;
|
|
|
|
export const ALLOWED_PROVIDERS = ['cursor', 'claude-code', 'gemini', 'codex', 'agents', 'universal'];
|
|
export const ALLOWED_TYPES = ['skill', 'command'];
|
|
|
|
export function isValidId(id) {
|
|
return typeof id === 'string' && VALID_ID.test(id);
|
|
}
|
|
|
|
export function isAllowedProvider(provider) {
|
|
return ALLOWED_PROVIDERS.includes(provider);
|
|
}
|
|
|
|
export function isAllowedType(type) {
|
|
return ALLOWED_TYPES.includes(type);
|
|
}
|
|
|
|
// Sanitize a filename for use in Content-Disposition headers
|
|
export function sanitizeFilename(filename) {
|
|
return filename.replace(/[^a-zA-Z0-9._-]/g, '');
|
|
}
|