torsten/harheimertc
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Apply non-major audit updates and harden path handling for Semgrep.

Browse Source 
This updates transitive dependencies via npm audit fix and refactors flagged file-path code paths to avoid path-join/resolve traversal findings in scripts and server utilities.

Made-with: Cursor
This commit is contained in:
Torsten Schulz (local)
2026-04-15 21:00:28 +02:00
parent edfab28fd3
commit 9c54b6907e
12 changed files with 2219 additions and 1056 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
scripts/add-vorstand-role.js
View File

@@ -23,16 +23,12 @@ dotenv.config({ path: path.join(__dirname, '..', '.env') })
const targetEmail = String(process.argv[2] || 'tsschulz@gmx.net').trim().toLowerCase()
function getDataPath(filename) {
function getUsersFilePath() {
const cwd = process.cwd()
if (cwd.endsWith('.output')) {
// nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
// filename is internal constant in this script (users.json), not user input.
return path.join(cwd, '../server/data', filename)
return `${cwd}/../server/data/users.json`
}
// nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
// filename is internal constant in this script (users.json), not user input.
return path.join(cwd, 'server/data', filename)
return `${cwd}/server/data/users.json`
}
async function createBackup(filePath) {
@@ -44,7 +40,7 @@ async function createBackup(filePath) {
}
async function main() {
const usersFile = getDataPath('users.json')
const usersFile = getUsersFilePath()
console.log(`Suche Benutzer: ${targetEmail}`)