Arnaud
3042d289a0
Full list of the audit's confirmed findings and their fixes: - Stored XSS via unescaped JSON-LD on the public recipe page (app/r/[id]/page.tsx) — escape < before injecting. - CSP allowed unsafe-eval in production — now dev-only (Next prod never eval()s; only its HMR does). - avatarUrl accepted any URL with no ownership check — now takes an avatarKey issued by avatar-presign, validated server-side, same pattern as recipe/review photos. - No session revocation on password change/reset — both now revoke other sessions (revokeOtherSessions: true, revokeSessionsOnPasswordReset). - Rate-limit bypass via spoofable X-Forwarded-For — take the last (proxy-appended) hop instead of the first (client-supplied) one, matching the single-Traefik-hop topology. - Webhook signing secrets stored plaintext — now AES-256-GCM encrypted like every other secret in this app, with a legacy- plaintext fallback for pre-existing rows (bare hex has no ":", our ciphertext format always does). - Better Auth's own rate limiter defaulted to in-memory storage, ineffective across replicas — now backed by the same Redis as lib/rate-limit.ts (secondaryStorage), with storeSessionInDatabase explicit so session storage itself doesn't move as a side effect. - Presigned upload URLs didn't bind the declared file size to the actual upload, letting a client under-declare size (and quota charge) then PUT an arbitrarily large object — switched to S3 presigned POST with a signed content-length-range condition, enforced by the storage server itself. - generateMetadata() on the recipe page skipped the visibility filter the page body uses, leaking a private recipe's title via <title> to any signed-in user with the id. - Block/unblock had no rate limit, unlike follow/unfollow. - AI quota was charged even when a user's own BYOK key was used (their own credentials/billing) — added an isByok flag through the config-resolution chain and skip the charge when set. Also wired BYOK into generate/generate-from-idea/translate/import-url, which never looked it up at all before. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
75 lines
2.6 KiB
TypeScript
75 lines
2.6 KiB
TypeScript
import crypto from "crypto";
|
|
import { db } from "@epicure/db";
|
|
import { webhooks, webhookDeliveries } from "@epicure/db";
|
|
import { eq, and } from "@epicure/db";
|
|
import { safeFetch } from "@/lib/validate-webhook-url";
|
|
import { decrypt } from "@/lib/encrypt";
|
|
|
|
// Secrets created before encryption-at-rest was added are a bare 64-char hex
|
|
// string (crypto.randomBytes(32).toString("hex")) with no ":" separators —
|
|
// encrypt()'s output is always "iv:authTag:ciphertext". Fall back to treating
|
|
// the value as already-plaintext rather than a hard migration, since this is
|
|
// only reached with a value this app itself generated (never user input).
|
|
function decryptWebhookSecret(stored: string): string {
|
|
return stored.split(":").length === 3 ? decrypt(stored) : stored;
|
|
}
|
|
|
|
export const WEBHOOK_EVENTS = [
|
|
"recipe.created",
|
|
"recipe.updated",
|
|
"recipe.published",
|
|
"recipe.deleted",
|
|
"meal_plan.updated",
|
|
"shopping_list.completed",
|
|
"comment.added",
|
|
] as const;
|
|
|
|
export type WebhookEvent = (typeof WEBHOOK_EVENTS)[number];
|
|
|
|
export async function dispatchWebhook(userId: string, event: WebhookEvent, payload: object) {
|
|
const hooks = await db
|
|
.select()
|
|
.from(webhooks)
|
|
.where(and(eq(webhooks.userId, userId), eq(webhooks.active, true)));
|
|
|
|
const filtered = hooks.filter((h) => h.events.length === 0 || h.events.includes(event));
|
|
|
|
await Promise.allSettled(
|
|
filtered.map(async (hook) => {
|
|
const body = JSON.stringify({ event, payload, timestamp: new Date().toISOString() });
|
|
const sig = crypto.createHmac("sha256", decryptWebhookSecret(hook.secret)).update(body).digest("hex");
|
|
let statusCode = 0;
|
|
let success = false;
|
|
try {
|
|
// safeFetch resolves and pins the connection to a single validated IP
|
|
// (and re-validates + re-pins every redirect hop), so there's no
|
|
// separate re-resolution for a rebinding attack to exploit.
|
|
const res = await safeFetch(hook.url, {
|
|
method: "POST",
|
|
headers: {
|
|
"Content-Type": "application/json",
|
|
"X-Epicure-Signature": `sha256=${sig}`,
|
|
"X-Epicure-Event": event,
|
|
},
|
|
body,
|
|
signal: AbortSignal.timeout(10000),
|
|
});
|
|
statusCode = res.status;
|
|
success = res.ok;
|
|
} catch {
|
|
// delivery failed; statusCode stays 0, success stays false
|
|
}
|
|
await db.insert(webhookDeliveries).values({
|
|
id: crypto.randomUUID(),
|
|
webhookId: hook.id,
|
|
event,
|
|
payload: payload as Record<string, unknown>,
|
|
statusCode,
|
|
success,
|
|
attempts: 1,
|
|
createdAt: new Date(),
|
|
});
|
|
})
|
|
);
|
|
}
|