Dinawo/CDN-APP-INSIDER
1
0
Fork 1
Code Issues Pull Requests 1 Packages Projects Releases Wiki Activity

security: fix vulnerabilities and harden code (2026-03-12)
Some checks failed
continuous-integration/drone/push Build is passing
Details
continuous-integration/drone/pr Build is failing
Details

Browse Source 
Path traversal fixes:
- DeleteFile.js: use path.resolve() + symlink protection (CRITICAL)
- DeleteFileFolder.js: add path.resolve() validation + symlink check (CRITICAL)
- RenameFile.js: use path.resolve() with proper prefix check + symlink guard (HIGH)
- attachments.js: add baseDir validation + skip symlinks in recursive search (MEDIUM)

XSS fixes:
- dashboard.js: escape user input in onerror/onclick inline attributes (HIGH)
- paramadminsettingsetup.script.js: escape values in innerHTML template (MEDIUM)

Input validation:
- inputValidationMiddleware.js: block suspicious requests instead of logging only (MEDIUM)

Version bump: 1.2.2-beta → 1.2.3-beta
This commit is contained in:
.dinawo
2026-03-12 20:18:28 +01:00
parent 1fbfc28780
commit a8af857cd3
8 changed files with 101 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
public/js/dashboard.js
View File

@@ -1,4 +1,10 @@
// Dashboard JavaScript - Version corrigée
function escapeAttr(str) {
if (typeof str !== 'string') return '';
return str.replace(/&/g, '&amp;').replace(/'/g, '&#39;').replace(/"/g, '&quot;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
}
document.addEventListener('DOMContentLoaded', function() {
// Initialisation générale
initializeDashboard();
@@ -682,10 +688,10 @@ function createCollaborationModal(itemName, itemType, data) {
? data.activeUsers.map(user => `
<div class="collaboration-user-item">
<div class="user-avatar-wrapper">
<img src="${user.profilePicture || getDefaultAvatar(user.name)}"
alt="${user.name}"
<img src="${user.profilePicture || getDefaultAvatar(user.name)}"
alt="${escapeAttr(user.name)}"
class="user-avatar"
onerror="this.src='${getDefaultAvatar(user.name)}'">
onerror="this.src='${escapeAttr(getDefaultAvatar(user.name))}'">
<div class="user-status-indicator"></div>
</div>
<div class="user-details">
@@ -696,8 +702,8 @@ function createCollaborationModal(itemName, itemType, data) {
</div>
</div>
<div class="user-actions">
<button class="action-btn remove-btn"
onclick="removeCollaborator('${itemName}', '${itemType}', '${user.id}')"
<button class="action-btn remove-btn"
onclick="removeCollaborator('${escapeAttr(itemName)}', '${escapeAttr(itemType)}', '${escapeAttr(user.id)}')"
title="Retirer ce collaborateur">
<i class="fas fa-user-minus"></i>
</button>
@@ -794,10 +800,10 @@ function searchCollabUser(username, itemName, itemType, modal) {
<div class="search-result-item">
<div class="result-user-info">
<div class="result-avatar-wrapper">
<img src="${result.user.profilePicture || getDefaultAvatar(result.user.name)}"
alt="${result.user.name}"
<img src="${result.user.profilePicture || getDefaultAvatar(result.user.name)}"
alt="${escapeAttr(result.user.name)}"
class="result-avatar"
onerror="this.src='${getDefaultAvatar(result.user.name)}'">
onerror="this.src='${escapeAttr(getDefaultAvatar(result.user.name))}'">
</div>
<div class="result-details">
<div class="result-name">${result.user.name}</div>
@@ -807,8 +813,8 @@ function searchCollabUser(username, itemName, itemType, modal) {
</div>
</div>
</div>
<button class="btn btn-primary add-user-btn"
onclick="addCollaborator('${itemName}', '${itemType}', '${result.user.id}')"
<button class="btn btn-primary add-user-btn"
onclick="addCollaborator('${escapeAttr(itemName)}', '${escapeAttr(itemType)}', '${escapeAttr(result.user.id)}')"
title="Ajouter ce collaborateur">
<i class="fas fa-user-plus"></i>
<span>Ajouter</span>

9
public/js/paramadminsettingsetup.script.js
View File

@@ -1,3 +1,8 @@
function escapeAttr(str) {
if (typeof str !== 'string') return '';
return str.replace(/&/g, '&amp;').replace(/'/g, '&#39;').replace(/"/g, '&quot;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
}
const body = document.body;
const themeSwitcher = document.getElementById('themeSwitcher');
@@ -319,11 +324,11 @@ function addPath(type) {
const div = document.createElement('div');
div.className = 'flex items-center space-x-2 py-2 px-3 bg-gray-800 rounded-lg animate';
div.innerHTML = `
<span class="flex-1">${value}</span>
<span class="flex-1">${escapeAttr(value)}</span>
<button type="button" onclick="removePath(this)" class="text-gray-400 hover:text-red-500">
<i class="fas fa-times"></i>
</button>
<input type="hidden" name="logs[${type === 'exclude' ? 'excludePaths' : 'includeOnly'}][]" value="${value}">
<input type="hidden" name="logs[${type === 'exclude' ? 'excludePaths' : 'includeOnly'}][]" value="${escapeAttr(value)}">
`;
list.appendChild(div);
input.value = '';