mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-06-19 21:31:46 +00:00
jubnl
7b37d337c1
- SSRF: guard sendWebhook() with checkSsrf() + createPinnedAgent() to block
requests to loopback, link-local, private network, and cloud metadata endpoints
- XSS: escape subject, body, and ctaHref in buildEmailHtml() via escapeHtml()
to prevent HTML injection through user-controlled params (actor, preview, etc.)
- Encrypt webhook URLs at rest: apply maybe_encrypt_api_key on save
(settingsService for user URLs, authService for admin URL) and decrypt_api_key
on read in getUserWebhookUrl() / getAdminWebhookUrl()
- Log failed channel dispatches: inspect Promise.allSettled() results and log
rejections via logError instead of silently dropping them
- Log admin webhook failures: replace fire-and-forget .catch(() => {}) with
.catch(err => logError(...)) and await the call
- Migration 69: guard against missing notification_preferences table on fresh installs
- Migration 70: drop the now-unused notification_preferences table
- Refactor: extract applyUserChannelPrefs() helper to deduplicate
setPreferences / setAdminPreferences logic
- Tests: add SEC-016 (XSS, 5 cases) and SEC-017 (SSRF, 6 cases) test suites;
mock ssrfGuard in notificationService tests
49 lines
1.6 KiB
TypeScript
49 lines
1.6 KiB
TypeScript
import { db } from '../db/database';
|
|
import { maybe_encrypt_api_key } from './apiKeyCrypto';
|
|
|
|
const ENCRYPTED_SETTING_KEYS = new Set(['webhook_url']);
|
|
|
|
export function getUserSettings(userId: number): Record<string, unknown> {
|
|
const rows = db.prepare('SELECT key, value FROM settings WHERE user_id = ?').all(userId) as { key: string; value: string }[];
|
|
const settings: Record<string, unknown> = {};
|
|
for (const row of rows) {
|
|
try {
|
|
settings[row.key] = JSON.parse(row.value);
|
|
} catch {
|
|
settings[row.key] = row.value;
|
|
}
|
|
}
|
|
return settings;
|
|
}
|
|
|
|
function serializeValue(key: string, value: unknown): string {
|
|
const raw = typeof value === 'object' ? JSON.stringify(value) : String(value !== undefined ? value : '');
|
|
if (ENCRYPTED_SETTING_KEYS.has(key)) return maybe_encrypt_api_key(raw) ?? raw;
|
|
return raw;
|
|
}
|
|
|
|
export function upsertSetting(userId: number, key: string, value: unknown) {
|
|
db.prepare(`
|
|
INSERT INTO settings (user_id, key, value) VALUES (?, ?, ?)
|
|
ON CONFLICT(user_id, key) DO UPDATE SET value = excluded.value
|
|
`).run(userId, key, serializeValue(key, value));
|
|
}
|
|
|
|
export function bulkUpsertSettings(userId: number, settings: Record<string, unknown>) {
|
|
const upsert = db.prepare(`
|
|
INSERT INTO settings (user_id, key, value) VALUES (?, ?, ?)
|
|
ON CONFLICT(user_id, key) DO UPDATE SET value = excluded.value
|
|
`);
|
|
db.exec('BEGIN');
|
|
try {
|
|
for (const [key, value] of Object.entries(settings)) {
|
|
upsert.run(userId, key, serializeValue(key, value));
|
|
}
|
|
db.exec('COMMIT');
|
|
} catch (err) {
|
|
db.exec('ROLLBACK');
|
|
throw err;
|
|
}
|
|
return Object.keys(settings).length;
|
|
}
|