thePR0M3TH3AN/TORCH
1
0 Fork 0
mirror of https://github.com/PR0M3TH3AN/TORCH.git synced 2026-11-08 05:42:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): harden dashboard auth timing, XSS, and CSP

Browse Source 
- Fix timingSafeCompare to pad buffers to equal length before comparing,
  closing the content timing side-channel on length mismatch
- Replace innerHTML with textContent for error messages to prevent XSS
- Extract inline script from dashboard/index.html into dashboard/app.js
- Remove 'unsafe-inline' from script-src CSP directive
- Update security test to match new CSP policy

https://claude.ai/code/session_01GfwUNbgeMgXreFDbsNQMsS
This commit is contained in:
Claude committed 2026-02-19 20:53:15 +00:00
1 parent d74d81c0c3
commit e7ecd2617e
4 files changed
+811 -813
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

test/dashboard-security.test.mjs
+1 -1
View File
@@ -80,7 +80,7 @@ test('Dashboard File Access Security', async (t) => {
assert.ok(headers['content-security-policy'], 'CSP header missing');
const csp = headers['content-security-policy'];
assert.match(csp, /default-src 'self'/, 'CSP: missing default-src self');
assert.match(csp, /script-src 'self' 'unsafe-inline' https:\/\/cdn\.jsdelivr\.net/, 'CSP: missing script-src');
assert.match(csp, /script-src 'self' https:\/\/cdn\.jsdelivr\.net/, 'CSP: missing script-src');
assert.match(csp, /object-src 'none'/, 'CSP: missing object-src none');
// X-Content-Type-Options