Hermes 388a1fe487 [grade=B] DC-081: Input validation for 20 highest-risk mutating routes ...

Secures 20 mutating routes across 7 files against path traversal, shell
injection, and ReDoS vectors:
- containers.js: container ID validation + resource limit bounds (6 routes)
- recipes/manage.js: recipe ID slug validation (4 routes)
- tailscale.js: subdomain regex before interpolation + shell char blocking (2)
- workflows.js: workflow ID slug validation (3 routes)
- dependencies.js: service ID + dependsOn array validation (3 routes)
- logs.js: YYYY-MM-DD date format validation (1 route)
- sites.js: additional domain validation (1 route)

Uses existing REGEX patterns from constants.js. No new dependencies.
Codex: B (no blocking issues, 4 Low follow-ups for tests + strict bools).
1552/1552 tests pass, 0 regressions.

2026-08-12 06:20:48 -07:00

..

__tests__

[grade=A] DC-066: End-to-end billing integration test

2026-08-12 05:47:27 -07:00

assets

[grade=B] refactor(assets): delete two repo-debris files

2026-07-25 14:09:40 -07:00

ca

feat: 1.5.0 prep — API v1 cutover, LICENSE, CHANGELOG, CI

2026-05-17 11:38:45 -07:00

data

feat: restore monitoring widget + add sami-files template

2026-06-18 18:52:48 -07:00

generated-certs

Sync DNS2 production changes - removed obsolete test suite and refactored structure

2026-03-23 10:47:15 +01:00

pki

Sync DNS2 production changes - removed obsolete test suite and refactored structure

2026-03-23 10:47:15 +01:00

pylon

Standardize paths, add version endpoint, request timeouts, HOST env var, graceful shutdown

2026-06-10 19:36:05 -07:00

routes

[grade=B] DC-081: Input validation for 20 highest-risk mutating routes

2026-08-12 06:20:48 -07:00

scripts

[grade=A] P2-1 through P2-4: version sync, dead file cleanup, ESLint fixes

2026-08-10 20:28:36 -07:00

src

[grade=A] Fix DC production crash-loop: await listen()+close() in startup-validator port check

2026-08-12 06:13:38 -07:00

.dockerignore

DC-084/085/089/090: Quick wins batch

2026-08-12 02:24:28 -07:00

.eslintignore

fix(lint): Add ctx shim to routes/apps and routes/arr

2026-03-29 22:35:13 -07:00

.eslintrc.js

[grade=A] P2-1 through P2-4: version sync, dead file cleanup, ESLint fixes

2026-08-10 20:28:36 -07:00

.gitignore

DC-020: restore license-keygen.js + fix broken require paths (container crash-loop)

2026-06-29 07:22:33 -07:00

.license-counter

fix: service edit, CSRF token stability, and license restore (v1.1.1)

2026-03-23 13:39:05 -07:00

.license-secret

Initial commit: DashCaddy v1.0

2026-03-05 02:26:12 -08:00

.prettierignore

fix(lint): Add ctx shim to routes/apps and routes/arr

2026-03-29 22:35:13 -07:00

.prettierrc

fix(lint): Add ctx shim to routes/apps and routes/arr

2026-03-29 22:35:13 -07:00

Dockerfile

[grade=B] DC-074+DC-091: Multi-stage Dockerfile + Dependabot config

2026-08-12 05:10:01 -07:00

jest.config.js

[grade=B] DC-063: Coverage threshold adjustment + toDockerMountPath edge case test

2026-08-12 05:07:24 -07:00

license-keygen.js

DC-057: close checkout-to-license contract drift (grade B)

2026-08-04 14:18:49 -07:00

openapi.yaml

[grade=A] DC-062: Update OpenAPI spec from v1.0.0 to v1.15.0 — 112→276 paths (329 ops)

2026-08-12 04:52:35 -07:00

package-lock.json

DC-059: Joi validation middleware + schemas for destructive routes

2026-08-08 15:39:48 -07:00

package.json

DC-084/085/089/090: Quick wins batch

2026-08-12 02:24:28 -07:00

platform-paths.js

DC-050 harden dataDir + add image-layer migration

2026-07-20 00:53:05 -07:00

server.js

DC-050 harden dataDir + add image-layer migration

2026-07-20 00:53:05 -07:00

VERSION

bump version: cookie-only session

2026-07-24 05:14:56 -07:00