devsyncwrld/backspace
1
0
Fork 0
Code Issues Pull Requests Actions 26 Packages Projects Releases Wiki Activity

feat: security hardening, DB indexes, token revocation, and input validation

Browse Source 
- SSRF protection: DNS resolution + private IP blocking on metadata fetcher
- Upload security: CSP/X-Frame-Options headers, SVG forced download, nosniff
- Auth hardening: JWT secret min length, password min 8 chars, token revocation via password_changed_at
- Attachment ownership verification before linking to messages
- Message length limit (4000 chars) enforced on client and server
- Asset URL validation on avatar/banner updates
- Federation instance validation (domain regex, origin scheme, length limits)
- DB indexes on all FK columns for query performance
- Migrations: nullable moderator columns, dm_messages reply_to FK constraint
- File cleanup on avatar/banner replacement and space deletion
- Fastify trustProxy, AbortController on fetches, typing map size cap
This commit is contained in:
Jannis Braun
2026-03-15 00:06:15 +01:00
parent ed4dcdcf69
commit 7c544c1ff4
37 changed files with 892 additions and 178 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/web/src/utils/profileSync.ts
+6 -6
View File
@@ -62,7 +62,7 @@ async function pushProfileToRemote(inst: ConnectedInstance, homeUser: NonNullabl
try {
const blob = await downloadAsset(homeUser.avatar);
const attachment = await inst.api.uploads.upload(new File([blob], homeUser.avatar));
payload.avatar = attachment.filename;
payload.avatar = `/api/uploads/${attachment.filename}`;
} catch (err) {
console.warn('[ProfileSync] Failed to upload avatar to remote:', err);
}
@@ -75,7 +75,7 @@ async function pushProfileToRemote(inst: ConnectedInstance, homeUser: NonNullabl
try {
const blob = await downloadAsset(homeUser.banner);
const attachment = await inst.api.uploads.upload(new File([blob], homeUser.banner));
payload.banner = attachment.filename;
payload.banner = `/api/uploads/${attachment.filename}`;
} catch (err) {
console.warn('[ProfileSync] Failed to upload banner to remote:', err);
}
@@ -108,7 +108,7 @@ async function pullProfileFromRemote(inst: ConnectedInstance): Promise<void> {
try {
const blob = await downloadAsset(remoteUser.avatar, inst.origin);
const attachment = await api.uploads.upload(new File([blob], remoteUser.avatar.split('/').pop() || 'avatar'));
payload.avatar = attachment.filename;
payload.avatar = `/api/uploads/${attachment.filename}`;
} catch (err) {
console.warn('[ProfileSync] Failed to download/upload avatar from remote:', err);
}
@@ -121,7 +121,7 @@ async function pullProfileFromRemote(inst: ConnectedInstance): Promise<void> {
try {
const blob = await downloadAsset(remoteUser.banner, inst.origin);
const attachment = await api.uploads.upload(new File([blob], remoteUser.banner.split('/').pop() || 'banner'));
payload.banner = attachment.filename;
payload.banner = `/api/uploads/${attachment.filename}`;
} catch (err) {
console.warn('[ProfileSync] Failed to download/upload banner from remote:', err);
}
@@ -206,7 +206,7 @@ export async function syncProfileUpdateToRemotes(update: Partial<UpdateUserReque
if (avatarBlob && avatarFilename) {
try {
const attachment = await inst.api.uploads.upload(new File([avatarBlob], avatarFilename));
perInstPayload.avatar = attachment.filename;
perInstPayload.avatar = `/api/uploads/${attachment.filename}`;
} catch (err) {
console.warn(`[ProfileSync] Failed to upload avatar to ${inst.origin}:`, err);
}
@@ -220,7 +220,7 @@ export async function syncProfileUpdateToRemotes(update: Partial<UpdateUserReque
if (bannerBlob && bannerFilename) {
try {
const attachment = await inst.api.uploads.upload(new File([bannerBlob], bannerFilename));
perInstPayload.banner = attachment.filename;
perInstPayload.banner = `/api/uploads/${attachment.filename}`;
} catch (err) {
console.warn(`[ProfileSync] Failed to upload banner to ${inst.origin}:`, err);
}