From 30465c7833b5f041c27f48ef8f21834fd472b9be Mon Sep 17 00:00:00 2001
From: "Torsten Schulz (local)" <tsschulz@gmx.net>
Date: Fri, 17 Jul 2026 09:08:42 +0200
Subject: [PATCH] =?UTF-8?q?Verbessere=20Codequalit=C3=A4t=20und=20Sicherhe?=
 =?UTF-8?q?it=20durch=20Refactoring,=20Hinzuf=C3=BCgen=20von=20ESLint-Rege?=
 =?UTF-8?q?ln=20und=20Aktualisierung=20der=20OSV-Scanner-Konfiguration?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .gitea/workflows/code-analysis.yml            |  2 +-
 .osv-scanner.toml                             |  4 ++++
 components/ModalDialog.vue                    |  5 -----
 eslint.config.js                              | 22 +++++++++++++++++--
 pages/cms/newsletter.vue                      |  1 +
 pages/mannschaften/[slug].vue                 |  1 -
 pages/mitgliederbereich/index.vue             |  4 +---
 pages/mitgliederbereich/mitglieder.vue        |  5 -----
 pages/newsletter/subscribe.vue                |  2 --
 pages/registrieren.vue                        |  4 ----
 pages/verein/geschichte.vue                   |  1 +
 pages/verein/satzung.vue                      |  1 +
 pages/verein/tt-regeln.vue                    |  1 +
 pages/verein/ueber-uns.vue                    |  1 +
 server/api/auth/passkeys/login.post.js        |  3 ---
 server/api/membership/generate-pdf.post.js    |  2 --
 .../newsletter/groups/[id]/posts/list.get.js  |  1 +
 server/api/spielplan/table.get.js             |  1 -
 server/utils/members.js                       |  2 +-
 server/utils/pdf-form-filler.js               |  9 ++++----
 server/utils/pdf-generator-service.js         |  4 ++--
 server/utils/qttr-import.js                   | 10 ---------
 server/utils/spielplan-data.js                |  2 +-
 server/utils/spielplan-import.js              |  4 ----
 server/utils/termine.js                       |  1 -
 25 files changed, 40 insertions(+), 53 deletions(-)
 create mode 100644 .osv-scanner.toml

diff --git a/.gitea/workflows/code-analysis.yml b/.gitea/workflows/code-analysis.yml
index 8c799bc..7e0dcf8 100755
--- a/.gitea/workflows/code-analysis.yml
+++ b/.gitea/workflows/code-analysis.yml
@@ -116,7 +116,7 @@ jobs:
           chmod +x osv-scanner
           ./osv-scanner --version
           test -f ./package-lock.json
-          ./osv-scanner --lockfile ./package-lock.json
+          ./osv-scanner scan -L ./package-lock.json --config ./.osv-scanner.toml
 
   deploy-production:
     runs-on: ubuntu-latest
diff --git a/.osv-scanner.toml b/.osv-scanner.toml
new file mode 100644
index 0000000..a7904b6
--- /dev/null
+++ b/.osv-scanner.toml
@@ -0,0 +1,4 @@
+[[IgnoredVulns]]
+id = "GHSA-v3m3-f69x-jf25"
+ignoreUntil = 2026-12-31
+reason = "Temporary exception: Quill 2.0.3 is required by the current RichTextEditor implementation, and OSV currently reports no fixed version. Track upstream fix and remove this ignore once a patched release is available."
diff --git a/components/ModalDialog.vue b/components/ModalDialog.vue
index 3f4877a..08b47fb 100755
--- a/components/ModalDialog.vue
+++ b/components/ModalDialog.vue
@@ -151,11 +151,6 @@ const showConfirmModal = (title, message, action) => {
   showConfirm.value = true
 }
 
-const closeSuccess = () => {
-  showSuccessToast.value = false
-  if (toastTimeout) { clearTimeout(toastTimeout); toastTimeout = null }
-}
-
 const closeError = () => {
   showError.value = false
 }
diff --git a/eslint.config.js b/eslint.config.js
index cacf3af..7f8a288 100755
--- a/eslint.config.js
+++ b/eslint.config.js
@@ -25,14 +25,19 @@ export default [
         'useHead': 'readonly',
         'useFetch': 'readonly',
         'definePageMeta': 'readonly',
+        'defineNuxtPlugin': 'readonly',
+        'defineNitroPlugin': 'readonly',
         'defineNuxtRouteMiddleware': 'readonly',
         'defineEventHandler': 'readonly',
         'readBody': 'readonly',
+        'getMethod': 'readonly',
         'getCookie': 'readonly',
         'setCookie': 'readonly',
         'deleteCookie': 'readonly',
         'getHeader': 'readonly',
+        'getRequestURL': 'readonly',
         'setHeader': 'readonly',
+        'setResponseStatus': 'readonly',
         'getRouterParam': 'readonly',
         'getQuery': 'readonly',
         'sendStream': 'readonly',
@@ -66,8 +71,9 @@ export default [
       'vue/multi-word-component-names': 'off',
       'vue/no-v-html': 'warn',
       'no-unused-vars': ['warn', { 
-        argsIgnorePattern: '^_',
-        varsIgnorePattern: '^_'
+        argsIgnorePattern: '^_|^event$',
+        varsIgnorePattern: '^_',
+        caughtErrorsIgnorePattern: '^_|^e$|^err$|^error$'
       }],
       'vue/no-unused-vars': ['warn', {
         ignorePattern: '^_'
@@ -97,6 +103,18 @@ export default [
       'tests/**',
       'scripts/**'
     ]
+  },
+  {
+    files: [
+      'pages/cms/newsletter.vue',
+      'pages/verein/geschichte.vue',
+      'pages/verein/satzung.vue',
+      'pages/verein/tt-regeln.vue',
+      'pages/verein/ueber-uns.vue'
+    ],
+    rules: {
+      'vue/no-v-html': 'off'
+    }
   }
 ]
 
diff --git a/pages/cms/newsletter.vue b/pages/cms/newsletter.vue
index e3fb71f..c7b8b1f 100755
--- a/pages/cms/newsletter.vue
+++ b/pages/cms/newsletter.vue
@@ -167,6 +167,7 @@
                         </span>
                       </div>
                       <!-- nosemgrep: javascript.vue.security.audit.xss.templates.avoid-v-html -->
+                      <!-- eslint-disable-next-line vue/no-v-html -->
                       <div
                         class="text-sm text-gray-600 prose prose-sm max-w-none mb-3"
                         v-html="useSanitizeHtml(post.content.substring(0, 200) + (post.content.length > 200 ? '...' : ''))"
diff --git a/pages/mannschaften/[slug].vue b/pages/mannschaften/[slug].vue
index 7a2949a..7955601 100755
--- a/pages/mannschaften/[slug].vue
+++ b/pages/mannschaften/[slug].vue
@@ -362,7 +362,6 @@
 
 <script setup>
 import { ref, computed, onMounted } from 'vue'
-import { Users } from 'lucide-vue-next'
 
 const route = useRoute()
 
diff --git a/pages/mitgliederbereich/index.vue b/pages/mitgliederbereich/index.vue
index 901ab21..fbf74af 100755
--- a/pages/mitgliederbereich/index.vue
+++ b/pages/mitgliederbereich/index.vue
@@ -124,11 +124,9 @@
 </template>
 
 <script setup>
-import { User, Users, Newspaper, Check, Calendar } from 'lucide-vue-next'
+import { User, Users, Newspaper, Calendar } from 'lucide-vue-next'
 import { ref, onMounted } from 'vue'
 
-const authStore = useAuthStore()
-
 const birthdays = ref([])
 const loadingBirthdays = ref(true)
 
diff --git a/pages/mitgliederbereich/mitglieder.vue b/pages/mitgliederbereich/mitglieder.vue
index 4f5c8e7..3c6a4e4 100755
--- a/pages/mitgliederbereich/mitglieder.vue
+++ b/pages/mitgliederbereich/mitglieder.vue
@@ -1000,11 +1000,6 @@ const canEdit = computed(() => {
   return authStore.hasAnyRole('admin', 'vorstand')
 })
 
-const canViewContactData = computed(() => {
-  // Explicitly check for 'vorstand' role only
-  return authStore.hasRole('vorstand')
-})
-
 const isBirthdateRequired = computed(() => {
   return !editingMember.value || Boolean(editingMember.value?.geburtsdatum)
 })
diff --git a/pages/newsletter/subscribe.vue b/pages/newsletter/subscribe.vue
index 5e67087..bc5d8c3 100755
--- a/pages/newsletter/subscribe.vue
+++ b/pages/newsletter/subscribe.vue
@@ -162,8 +162,6 @@ const selectedGroup = computed(() => {
 })
 
 const isLoggedIn = computed(() => authStore.isLoggedIn)
-const userEmail = computed(() => authStore.user?.email || '')
-const userName = computed(() => authStore.user?.name || '')
 
 async function loadGroups() {
   try {
diff --git a/pages/registrieren.vue b/pages/registrieren.vue
index bef57ca..21875bb 100755
--- a/pages/registrieren.vue
+++ b/pages/registrieren.vue
@@ -394,7 +394,6 @@ const formData = ref({
 const isLoading = ref(false)
 const errorMessage = ref('')
 const successMessage = ref('')
-const usePasskey = ref(false)
 const isPasskeySupported = ref(false)
 const passkeySupportReason = ref('')
 const setPasswordForPasskey = ref(true)
@@ -424,7 +423,6 @@ const handleFormSubmit = (event) => {
   // console.log('[DEBUG] Calling handleRegister...')
   handleRegister()
 }
-const showDebugInfo = ref(false)
 const debugChallenge = ref('')
 const debugRpId = ref('')
 const debugRegistrationId = ref('')
@@ -697,8 +695,6 @@ const handleRegisterWithPasskey = async () => {
       debugSmartphoneUrl.value = `${window.location.origin}/passkey-register-cross-device?registrationId=${pre.registrationId}`
     }
     
-    showDebugInfo.value = true
-    
     console.log('[DEBUG] QR-Code Info (for Cross-Device):', {
       challenge: pre.options?.challenge,
       challengeLength: pre.options?.challenge?.length,
diff --git a/pages/verein/geschichte.vue b/pages/verein/geschichte.vue
index ea68b47..be80546 100755
--- a/pages/verein/geschichte.vue
+++ b/pages/verein/geschichte.vue
@@ -5,6 +5,7 @@
         Geschichte
       </h1>
       <!-- nosemgrep: javascript.vue.security.audit.xss.templates.avoid-v-html -->
+      <!-- eslint-disable-next-line vue/no-v-html -->
       <div
         class="prose prose-lg max-w-none"
         v-html="content"
diff --git a/pages/verein/satzung.vue b/pages/verein/satzung.vue
index c8d1c90..2c2142a 100755
--- a/pages/verein/satzung.vue
+++ b/pages/verein/satzung.vue
@@ -6,6 +6,7 @@
       </h1>
       
       <!-- nosemgrep: javascript.vue.security.audit.xss.templates.avoid-v-html -->
+      <!-- eslint-disable-next-line vue/no-v-html -->
       <div
         class="prose prose-lg max-w-none mb-8"
         v-html="content"
diff --git a/pages/verein/tt-regeln.vue b/pages/verein/tt-regeln.vue
index 4f4d7de..a6fbbd0 100755
--- a/pages/verein/tt-regeln.vue
+++ b/pages/verein/tt-regeln.vue
@@ -5,6 +5,7 @@
         TT-Regeln
       </h1>
       <!-- nosemgrep: javascript.vue.security.audit.xss.templates.avoid-v-html -->
+      <!-- eslint-disable-next-line vue/no-v-html -->
       <div
         class="prose prose-lg max-w-none"
         v-html="content"
diff --git a/pages/verein/ueber-uns.vue b/pages/verein/ueber-uns.vue
index c9c6ce2..32464a4 100755
--- a/pages/verein/ueber-uns.vue
+++ b/pages/verein/ueber-uns.vue
@@ -5,6 +5,7 @@
         Über uns
       </h1>
       <!-- nosemgrep: javascript.vue.security.audit.xss.templates.avoid-v-html -->
+      <!-- eslint-disable-next-line vue/no-v-html -->
       <div
         class="prose prose-lg max-w-none"
         v-html="content"
diff --git a/server/api/auth/passkeys/login.post.js b/server/api/auth/passkeys/login.post.js
index fe82cac..8ee28e5 100755
--- a/server/api/auth/passkeys/login.post.js
+++ b/server/api/auth/passkeys/login.post.js
@@ -9,9 +9,6 @@ import { getClientIp } from '../../../utils/rate-limit.js'
 
 // Local fallback for Nitro globals when lint/run env doesn't provide them
 const getMethod = globalThis.getMethod ?? ((e) => (e?.req?.method || e?.method || 'GET'))
-const getRequestURL = globalThis.getRequestURL ?? ((e) => {
-  try { return new URL(e?.req?.url, 'http://localhost') } catch { return { href: String(e?.req?.url || ''), pathname: String(e?.req?.url || '').split('?')[0] || '' } }
-})
 
 function findUserByCredentialId(users, credentialId) {
   const cid = String(credentialId || '')
diff --git a/server/api/membership/generate-pdf.post.js b/server/api/membership/generate-pdf.post.js
index 038fd9e..32d56e2 100755
--- a/server/api/membership/generate-pdf.post.js
+++ b/server/api/membership/generate-pdf.post.js
@@ -613,7 +613,6 @@ export default defineEventHandler(async (event) => {
   // E-Mail senden via zentralen Service (pass full path)
   emailResult = await sendMembershipEmailUtil(data, finalPdfPath)
         // Antragsdaten verschlüsselt speichern
-        const encryptionKey = process.env.ENCRYPTION_KEY || 'local_development_encryption_key_change_in_production'
         const encryptedData = JSON.stringify(data)
         // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
         // filename is generated from timestamp, not user input, path traversal prevented
@@ -674,7 +673,6 @@ export default defineEventHandler(async (event) => {
   emailResult = await sendMembershipEmailUtil(data, finalPdfPath)
       
       // Antragsdaten verschlüsselt speichern
-      const encryptionKey = process.env.ENCRYPTION_KEY || 'local_development_encryption_key_change_in_production'
       const encryptedData = JSON.stringify(data)
       // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
       // filename is generated from timestamp, not user input, path traversal prevented
diff --git a/server/api/newsletter/groups/[id]/posts/list.get.js b/server/api/newsletter/groups/[id]/posts/list.get.js
index 57f54d2..6e4989e 100755
--- a/server/api/newsletter/groups/[id]/posts/list.get.js
+++ b/server/api/newsletter/groups/[id]/posts/list.get.js
@@ -1,6 +1,7 @@
 import fs from 'fs/promises'
 import path from 'path'
 import { getUserFromToken, hasAnyRole } from '../../../../../utils/auth.js'
+import { decryptObject } from '../../../../../utils/encryption.js'
 
 // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
 // filename is always a hardcoded constant (e.g., 'newsletter-posts.json'), never user input
diff --git a/server/api/spielplan/table.get.js b/server/api/spielplan/table.get.js
index 6547bc8..5c9aae7 100755
--- a/server/api/spielplan/table.get.js
+++ b/server/api/spielplan/table.get.js
@@ -1,5 +1,4 @@
 import { promises as fs } from 'fs'
-import path from 'path'
 import { getCurrentSeasonSlug, validateSeasonSlug } from '../../utils/spielplan-data.js'
 import { getServerDataPath } from '../../utils/paths.js'
 import { error as loggerError } from '../../utils/logger.js'
diff --git a/server/utils/members.js b/server/utils/members.js
index 4e0ea25..063c024 100755
--- a/server/utils/members.js
+++ b/server/utils/members.js
@@ -1,7 +1,7 @@
 import { promises as fs } from 'fs'
 import path from 'path'
 import { randomUUID } from 'crypto'
-import { encrypt, decrypt, encryptObject, decryptObject } from './encryption.js'
+import { encryptObject, decryptObject } from './encryption.js'
 import { writeDataFileWithRotation } from './data-file-rotation.js'
 
 // Handle both dev and production paths
diff --git a/server/utils/pdf-form-filler.js b/server/utils/pdf-form-filler.js
index f1094bf..92f1d87 100755
--- a/server/utils/pdf-form-filler.js
+++ b/server/utils/pdf-form-filler.js
@@ -106,7 +106,7 @@ export async function fillFormFields(pdfDoc, form, data) {
   try {
     const helveticaFont = await pdfDoc.embedFont(StandardFonts.Helvetica)
     form.updateFieldAppearances(helveticaFont)
-  } catch (_error) {
+  } catch (error) {
     console.warn('Could not update field appearances:', error.message)
   }
 }
@@ -123,7 +123,7 @@ export async function fillPdfForm(pdfDoc, form, data) {
     
     // Check if PLZ/Ort field on page 1 is empty and fix it
     await fixPLZOrtField(pdfDoc, data)
-  } catch (_error) {
+  } catch (error) {
     console.warn('Form filling failed, using fallback:', error.message)
     await fillFormFieldsPositionally(pdfDoc, data)
   }
@@ -136,7 +136,6 @@ export async function fillPdfForm(pdfDoc, form, data) {
  */
 async function fixPLZOrtField(pdfDoc, data) {
   try {
-    const pages = pdfDoc.getPages()
     await pdfDoc.embedFont(StandardFonts.Helvetica)
     
     // Draw PLZ/Ort at the correct position on page 1
@@ -160,7 +159,7 @@ async function fixPLZOrtField(pdfDoc, data) {
       }
     }
     
-  } catch (_error) {
+  } catch (error) {
     console.warn('Could not fix PLZ/Ort field:', error.message)
   }
 }
@@ -221,7 +220,7 @@ async function fillFormFieldsPositionally(pdfDoc, data) {
       firstPage.drawText('X', { x: 116, y: -8, size: 12, font: helveticaFont })
     }
     
-  } catch (_error) {
+  } catch (error) {
     console.error('Positional filling failed:', error.message)
   }
 }
diff --git a/server/utils/pdf-generator-service.js b/server/utils/pdf-generator-service.js
index 586ebdf..cbab385 100755
--- a/server/utils/pdf-generator-service.js
+++ b/server/utils/pdf-generator-service.js
@@ -54,7 +54,7 @@ export class PDFGeneratorService {
       const pdfBytes = await pdfDoc.save()
       
       return new PDFGenerationResult(true, Buffer.from(pdfBytes), filename)
-    } catch (_error) {
+    } catch (error) {
       console.error('Template PDF generation failed:', error.message)
       return new PDFGenerationResult(false, null, null, error.message)
     }
@@ -84,7 +84,7 @@ export class PDFGeneratorService {
    * @param {Object} data - Form data
    * @returns {string} Filename
    */
-  generateFilename(data) {
+  generateFilename(_data) {
     const timestamp = Date.now()
     return `beitrittserklärung_${timestamp}.pdf`
   }
diff --git a/server/utils/qttr-import.js b/server/utils/qttr-import.js
index cc5d7bf..5c5428d 100755
--- a/server/utils/qttr-import.js
+++ b/server/utils/qttr-import.js
@@ -57,16 +57,6 @@ function toNumberOrNull(value) {
   return Number.isNaN(numberValue) ? null : numberValue
 }
 
-function normalizeName(value) {
-  return String(value || '')
-    .trim()
-    .toLowerCase()
-    .normalize('NFKD')
-    .replace(/[\u0300-\u036f]/g, '')
-    .replace(/\s+/g, ' ')
-    .replace(/[’'`]/g, '')
-}
-
 function normalizeGender(value) {
   const normalized = String(value || '').trim().toLowerCase()
   if (normalized === 'm' || normalized === 'männlich') return 'männlich'
diff --git a/server/utils/spielplan-data.js b/server/utils/spielplan-data.js
index 7011906..c2a47f2 100755
--- a/server/utils/spielplan-data.js
+++ b/server/utils/spielplan-data.js
@@ -1,7 +1,7 @@
 import { promises as fs } from 'fs'
 import path from 'path'
 import { getProjectPath, getServerDataPath } from './paths.js'
-import { error as loggerError, info as loggerInfo } from './logger.js'
+import { error as loggerError } from './logger.js'
 
 const SPIELPLAN_HEADERS = [
   'Termin',
diff --git a/server/utils/spielplan-import.js b/server/utils/spielplan-import.js
index c01f143..f1354e3 100755
--- a/server/utils/spielplan-import.js
+++ b/server/utils/spielplan-import.js
@@ -12,10 +12,6 @@ const OUTPUT_DIR = getServerDataPath('spielplan-import')
 const JSON_FILE = path.join(OUTPUT_DIR, 'harheimer_tc_spielplan.json')
 const HTML_FILE = path.join(OUTPUT_DIR, 'harheimer_tc_spielplan.html')
 
-function pad2(value) {
-  return String(value).padStart(2, '0')
-}
-
 export function getSpieljahrForDate(date = new Date()) {
   const year = date.getFullYear()
   const startYear = date.getMonth() >= 6 ? year : year - 1
diff --git a/server/utils/termine.js b/server/utils/termine.js
index c879c20..473f83b 100755
--- a/server/utils/termine.js
+++ b/server/utils/termine.js
@@ -1,5 +1,4 @@
 import { promises as fs } from 'fs'
-import path from 'path'
 import { randomUUID } from 'crypto'
 import { writeDataFileWithRotation } from './data-file-rotation.js'