security: fix XSS, window.opener exposure, and Electron CSP#185
Merged
Conversation
github-actions
Bot
added
the
documentation
Deploying timetrackerpro with
|
| Latest commit: |
a4526e3
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://f9601ab2.timetrackerpro.pages.dev |
| Branch Preview URL: | https://security-audit.timetrackerpro.pages.dev |
Closed
2 tasks
- Sanitize client contactWebsite with URL() before rendering as href; javascript: and other non-http(s) schemes fall back to plain text - Add rel="noopener noreferrer" to all target="_blank" sidebar links - Remove 'unsafe-inline' and 'unsafe-eval' from Electron script-src CSP; production build uses only <script type="module">, neither directive was needed
- vite 5.4.21 → 6.4.3 (GHSA: server.fs.deny bypass on Windows, NTLMv2 hash) - vitest 1.6.1 → 3.2.6 (GHSA: arbitrary file read/execute via UI server) - react-router-dom constraint floor raised to ^6.30.4 (open redirect fix) - hono pinned to 4.12.25 as direct devDep (CORS, path traversal, Lambda fixes) - form-data pinned to 4.0.6 as direct devDep (CRLF injection fix) - .npmrc added to declare build script allowlist for esbuild, @swc/core, electron-winstaller, msw (pnpm v10 moved onlyBuiltDependencies from package.json#pnpm to .npmrc)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Security audit + Dependabot remediation. Two categories of changes:
Code fixes (code review required):
contactWebsiteURLs viaURL()— blocksjavascript:URI injectionrel="noopener noreferrer"to alltarget="_blank"sidebar links'unsafe-inline'and'unsafe-eval'fromscript-srcDependency upgrades (Dependabot alerts):
vitest1.6.1 → 3.2.6 (CRITICAL: arbitrary file read via UI server)vite5.4.21 → 6.4.3 (HIGH:server.fs.denybypass, NTLMv2 disclosure on Windows)react-router-domfloor raised to^6.30.4(MEDIUM: open redirect)honopinned to4.12.25as direct devDep (HIGH: CORS, path traversal, Lambda issues)form-datapinned to4.0.6as direct devDep (HIGH: CRLF injection).npmrcadded:only-built-dependenciesallowlist for pnpm v10Type of Change
Related Issue
Closes #
Changes Made
src/components/ClientManagement.tsx— URL sanitization viaURL()before renderinghrefsrc/components/AppSidebar.tsx—rel="noopener noreferrer"on alltarget="_blank"linkselectron/main.ts— CSPscript-srctightened to'self'onlypackage.json— vite, vitest, react-router-dom bumped; hono + form-data pinned as devDepspnpm-lock.yaml— lockfile regenerated.npmrc— pnpm v10 build script allowlistCHANGELOG.md—### Securitysection for all fixesdocs/SECURITY.md— "Dependency Vulnerability Management" and "Frontend Security Controls" sections addedChecklist
Documentation
README.mdCHANGELOG.mdupdated accordinglyGeneral
mainpnpm lintandpnpm buildNotes for Reviewers
The
contactWebsitesanitization uses an IIFE inside JSX to keep the URL validation inline with the render. Can be extracted to asanitizeUrlutility if preferred.pnpm's
overridesfield did not force version bumps forhonoandform-data(pnpm resolves to the minimum satisfying version and won't bump it via overrides alone). They are pinned as directdevDependenciesas a workaround — this is the correct pattern for pnpm v10.vite5 → 6 andvitest1 → 3 are major version bumps. Both@vitejs/plugin-react-swcandvite-plugin-pwaexplicitly support vite 6.pnpm lintandpnpm buildpass cleanly. Test suite should be run before merge.