Add security comments to path handling in various scripts to clarify internal constant usage and mitigate path traversal risks. Update logging in registration and verification processes for improved clarity.

server/utils/encryption.js

@@ -110,7 +110,7 @@ function decryptV2GCM(encryptedData, password) {
     }
 
     const key = deriveKey(password, salt)
-    const decipher = crypto.createDecipheriv(ALGORITHM, key, iv)
+    const decipher = crypto.createDecipheriv(ALGORITHM, key, iv, { authTagLength: AUTH_TAG_LENGTH })
     decipher.setAuthTag(tag)
 
     const decrypted = Buffer.concat([

server/utils/paths.js

@@ -6,6 +6,8 @@ function uniqueCandidates(candidates) {
 }
 
 function hasServerDataDir(root) {
+  // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
+  // root candidates come only from APP_ROOT/cwd/parent and are used only for existence checks.
   return fs.existsSync(path.join(root, 'server', 'data'))
 }
 

server/utils/termine.js

@@ -9,8 +9,12 @@ const getDataPath = (filename) => {
   // Prefer server/data in both production and development
   // e.g. project-root/server/data/termine.csv or .output/server/data/termine.csv
   if (cwd.endsWith('.output')) {
+    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
+    // filename is internal constant ('termine.csv').
     return path.join(cwd, '../server/data', filename)
   }
+  // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
+  // filename is internal constant ('termine.csv').
   return path.join(cwd, 'server/data', filename)
 }