torsten/harheimertc
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add security comments to path handling in various scripts to clarify internal constant usage and mitigate path traversal risks. Update logging in registration and verification processes for improved clarity.
Some checks failed
Code Analysis (JS/Vue) / analyze (push) Failing after 2m48s
Details

Browse Source
This commit is contained in:
Torsten Schulz (local)
2026-04-15 20:52:38 +02:00
parent 5f79d220cf
commit edfab28fd3
14 changed files with 46 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
server/api/cms/save-csv.post.js
View File

@@ -94,7 +94,11 @@ export default defineEventHandler(async (event) => {
// Ziel: internes Datenverzeichnis unter `server/data/public-data` (persistente, interne Quelle)
const internalPaths = [
// nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
// filename is allowlisted via allowedFiles above.
path.join(cwd, 'server/data/public-data', filename),
// nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
// filename is allowlisted via allowedFiles above.
path.join(cwd, '../server/data/public-data', filename)
]