jubnl b109c1340a fix: prevent ICS header injection in calendar export ...

Three vulnerabilities patched in the /export.ics route:

- esc() now handles bare \r and CRLF sequences — the previous regex only
  matched \n, leaving \r intact and allowing CRLF injection via \r\n
- reservation DESCRIPTION field was built from unescaped user data
  (type, confirmation_number, notes, airline, flight/train numbers,
  airports) and written raw into ICS output; now passed through esc()
- Content-Disposition filename used ICS escaping instead of HTTP header
  sanitization; replaced with a character allowlist to prevent " and
  \r\n injection into the response header

2026-04-01 07:58:18 +02:00

..

db

fix: encrypt Immich API key at rest using AES-256-GCM

2026-04-01 07:57:29 +02:00

demo

v2.6.2 — TREK Rebrand, OSM Enrichment, File Management, Hotel Bookings & Bug Fixes

2026-03-28 16:38:08 +01:00

mcp

Merge pull request #179 from shanelord01/audit/remediation-clean

2026-03-31 20:53:48 +02:00

middleware

fix: pin JWT algorithm to HS256 and harden token security

2026-03-31 00:33:53 +00:00

routes

fix: prevent ICS header injection in calendar export

2026-04-01 07:58:18 +02:00

services

fix: decouple at-rest encryption from JWT_SECRET, add JWT rotation

2026-04-01 07:57:55 +02:00

config.ts

fix: remove JWT_SECRET env var — server manages it exclusively

2026-04-01 07:58:05 +02:00

index.ts

fix: remove JWT_SECRET env var — server manages it exclusively

2026-04-01 07:58:05 +02:00

scheduler.ts

feat: configurable trip reminders, admin full access, and enhanced audit logging

2026-03-31 22:23:38 +03:00

types.ts

feat: notifications, audit logging, and admin improvements

2026-03-31 22:23:23 +03:00

websocket.ts

fix: replace JWT tokens in URL query params with short-lived ephemeral tokens

2026-04-01 07:57:14 +02:00