sami7777/dashcaddy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

P0-3, P0-4, P0-5: mark done in backlog
CI / Test & Lint (push) Has been cancelled
Details
CI / Security audit (push) Has been cancelled
Details

Browse Source
This commit is contained in:
Hermes
2026-08-08 03:36:52 -07:00
parent 609ccd32c4
commit 55a50fdeb7
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
DC-PRODUCTION-GRADE-BACKLOG.md
+3 -3
View File
@@ -7,9 +7,9 @@ If an item is too big for one tick, implement a sub-part, push that, and note pr
- [x] **P0-1: npm audit fix** — Done (commit 3a0a5bc, grade A). Resolved 3 high CVEs via minimatch 9.0.9 in webdav transitive. 4 remaining vulns are semver-major-only (sharp→0.35.3, dockerode→5.0.1, nodemailer→9.0.5, uuid→11.1.1) — deferred per backlog note. All 1498 jest tests pass. URN urn:ump:hlju4hixg3tijbghncigm5gesoemupuczrzmkykumh7xbgkq3d2q. - [x] **P0-1: npm audit fix** — Done (commit 3a0a5bc, grade A). Resolved 3 high CVEs via minimatch 9.0.9 in webdav transitive. 4 remaining vulns are semver-major-only (sharp→0.35.3, dockerode→5.0.1, nodemailer→9.0.5, uuid→11.1.1) — deferred per backlog note. All 1498 jest tests pass. URN urn:ump:hlju4hixg3tijbghncigm5gesoemupuczrzmkykumh7xbgkq3d2q.
- [x] **P0-2: Command injection in ca.js:210** — Done (commit 66e4460, grade A). Replaced `execSync(\`openssl pkcs12 ... -password "pass:${password}"\`)` with `execFileSync('openssl', [..., '-password', \`pass:${password}\`])`. No shell parsing. All 1498 tests pass. - [x] **P0-2: Command injection in ca.js:210** — Done (commit 66e4460, grade A). Replaced `execSync(\`openssl pkcs12 ... -password "pass:${password}"\`)` with `execFileSync('openssl', [..., '-password', \`pass:${password}\`])`. No shell parsing. All 1498 tests pass.
- [ ] **P0-3: Unvalidated req.body in backup config** — `routes/backups.js:487` passes raw `req.body` to `backupManager.updateConfig()`. Replace with explicit destructure of known fields: `const { backups, defaultRetention } = req.body || {}`. - [x] **P0-3: Unvalidated req.body in backup config** — Done (commit b3488f1, grade A). POST /backups/config now destructures only `{backups, defaultRetention}` instead of passing `req.body` wholesale. All 1498 tests pass.
- [ ] **P0-4: Asset upload buffer size check** — `routes/config/assets.js:33` decodes base64 without checking buffer size. Add `if (buffer.length > 5 * 1024 * 1024) throw new ValidationError('File too large (max 5MB)')` after the `Buffer.from` call. Also restrict MIME regex to `png|jpeg|svg+xml|webp|ico|x-icon`. - [x] **P0-4: Asset upload buffer size check** — Done (commit 57ed09f, grade A). POST /assets/upload now uses `decodeImageData(data)` helper which enforces MIME whitelist (png/jpeg/jpg/svg+xml/webp/ico/x-icon) and 5 MB cap. (Prior partial fix had the helper but never wired it.) All 1498 tests pass.
- [ ] **P0-5: Error message leaking internals** — `routes/apps/restore.js:296` returns `err.message` directly to client via `errorResponse(res, 500, err.message)`. Replace with generic message `"Restore failed"` and log the actual error server-side. - [x] **P0-5: Error message leaking internals** — Done (commit 609ccd3, grade A). apps-revert catch now logs `err.message`+stack via `log.error` server-side and returns generic `Revert failed` to client. All 1498 tests pass.
## P1 — Architecture & Input Validation ## P1 — Architecture & Input Validation