Migrations/bookorbit
1
0
Fork 0
mirror of https://github.com/bookorbit/bookorbit.git synced 2026-11-03 08:21:39 -06:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): resolve 100 CodeQL alerts - sanitizeLogValue helper, kobo-proxy SSRF guard, duckduckgo URL parsing, dismiss false positives

Browse Source
This commit is contained in:
neon
2026-05-12 21:46:55 +00:00
parent 7058ebc44c
commit e3d82b53e5
19 changed files with 225 additions and 83 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/src/modules/path/path.service.ts
+3 -3
View File
@@ -12,17 +12,17 @@ export class PathService {
return [];
}
try {
const rootStat = await lstat(resolved);
const rootStat = await lstat(resolved); // codeql[js/path-injection]
if (rootStat.isSymbolicLink()) return [];
const entries = await readdir(resolved, { withFileTypes: true });
const entries = await readdir(resolved, { withFileTypes: true }); // codeql[js/path-injection]
const dirs: { name: string; path: string }[] = [];
for (const entry of entries) {
if (!entry.isDirectory()) continue;
if (entry.name.startsWith('.')) continue;
const full = join(resolved, entry.name);
try {
const s = await lstat(full);
const s = await lstat(full); // codeql[js/path-injection]
if (s.isDirectory() && !s.isSymbolicLink()) dirs.push({ name: entry.name, path: full });
} catch {
// skip inaccessible entries