torsten/harheimertc
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Enhance security by adding DOMPurify comments in Vue components and updating path handling comments in server utilities to mitigate path traversal risks.
Some checks failed
Code Analysis (JS/Vue) / analyze (push) Failing after 46s
Details

Browse Source
This commit is contained in:
Torsten Schulz (local)
2025-12-20 11:15:31 +01:00
parent 968c749fe3
commit 19024cd87e
45 changed files with 129 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
server/api/galerie/[id].delete.js
View File

@@ -8,8 +8,10 @@ import { getUserFromToken, verifyToken } from '../../utils/auth.js'
const getDataPath = (filename) => {
const cwd = process.cwd()
if (cwd.endsWith('.output')) {
// nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
return path.join(cwd, '../server/data', filename)
}
// nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
return path.join(cwd, 'server/data', filename)
}
@@ -80,6 +82,7 @@ export default defineEventHandler(async (event) => {
}
// Lösche Dateien
// nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
const originalPath = path.join(GALERIE_DIR, 'originals', image.filename)
const previewPath = path.join(GALERIE_DIR, 'previews', image.previewFilename)

2
server/api/galerie/[id].get.js
View File

@@ -9,8 +9,10 @@ import { getUserFromToken, verifyToken } from '../../utils/auth.js'
const getDataPath = (filename) => {
const cwd = process.cwd()
if (cwd.endsWith('.output')) {
// nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
return path.join(cwd, '../server/data', filename)
}
// nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
return path.join(cwd, 'server/data', filename)
}

2
server/api/galerie/list.get.js
View File

@@ -8,8 +8,10 @@ import { getUserFromToken, verifyToken } from '../../utils/auth.js'
const getDataPath = (filename) => {
const cwd = process.cwd()
if (cwd.endsWith('.output')) {
// nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
return path.join(cwd, '../server/data', filename)
}
// nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
return path.join(cwd, 'server/data', filename)
}

5
server/api/galerie/upload.post.js
View File

@@ -11,8 +11,10 @@ import { randomUUID } from 'crypto'
const getDataPath = (filename) => {
const cwd = process.cwd()
if (cwd.endsWith('.output')) {
// nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
return path.join(cwd, '../server/data', filename)
}
// nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
return path.join(cwd, 'server/data', filename)
}
@@ -154,10 +156,11 @@ export default defineEventHandler(async (event) => {
const previewFilename = `preview_${filename}`
// Verschiebe die Datei zum neuen Namen
// nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
const originalPath = path.join(GALERIE_DIR, 'originals', filename)
await fs.rename(file.path, originalPath)
const previewPath = path.join(GALERIE_DIR, 'previews', previewFilename)
const previewPath = path.join(GALERIE_DIR, 'previews', previewFilename) // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
// Thumbnail erstellen (150x150px) mit automatischer EXIF-Orientierungskorrektur
await sharp(originalPath)