feat: security hardening, DB indexes, token revocation, and input validation

- SSRF protection: DNS resolution + private IP blocking on metadata fetcher
- Upload security: CSP/X-Frame-Options headers, SVG forced download, nosniff
- Auth hardening: JWT secret min length, password min 8 chars, token revocation via password_changed_at
- Attachment ownership verification before linking to messages
- Message length limit (4000 chars) enforced on client and server
- Asset URL validation on avatar/banner updates
- Federation instance validation (domain regex, origin scheme, length limits)
- DB indexes on all FK columns for query performance
- Migrations: nullable moderator columns, dm_messages reply_to FK constraint
- File cleanup on avatar/banner replacement and space deletion
- Fastify trustProxy, AbortController on fetches, typing map size cap

This commit is contained in:

Jannis Braun

2026-03-15 00:06:15 +01:00

parent ed4dcdcf69

commit 7c544c1ff4

37 changed files with 892 additions and 178 deletions

									
										packages/web/src/components/chat/MarkdownRenderer.tsx
									
		+2
		
												View File
												
				@@ -192,6 +192,8 @@ function buildComponents(): Components {

				        alt={alt ?? ''}

				        className="max-w-full max-h-[350px] rounded-md mt-1"

				        loading="lazy"

				        referrerPolicy="no-referrer"

				        crossOrigin="anonymous"

				      />

				    ),