Release: staging -> main (2026-05-18 02:06)

.jules/sentinel.md

@@ -16,3 +16,7 @@
 **Issue:** String exceptions were not handled, causing the app to return an Internal Server Error.
 **Learning:** `e instanceof Error` correctly identifies built-in errors, but doesn't handle `throw "error"`. It caused Hono to not correctly propagate a 500 status.
 **Prevention:** Handled by validating `e instanceof Error ? e.message : typeof e === 'string' ? e : "";` and throwing an error properly at the end `throw e instanceof Error ? e : new Error(String(e));`.
+## 2026-05-15 - [IPスプーフィングの脆弱性]
+**Vulnerability:** X-Forwarded-For ヘッダーを使用した IP アドレスのフォールバック
+**Learning:** Cloudflare Workers 環境などでは CF-Connecting-IP が信頼できる IP アドレスのソースとなります。X-Forwarded-For にフォールバックすると、クライアントがヘッダーを偽装（スプーフィング）し、IP ベースのアクセス制御やレート制限を回避できる可能性があります。
+**Prevention:** 信頼できるロードバランサーや CDN が設定するヘッダー（例：CF-Connecting-IP）のみを使用し、クライアントから送信される可能性のあるヘッダー（例：X-Forwarded-For）へのフォールバックは避ける。

apps/api/src/routes/__tests__/orgs.test.ts

@@ -2213,4 +2213,25 @@ describe("orgs routes", () => {
       expect(body.error).toContain("last admin");
     });
   });
+
+  describe("GET /api/orgs/:slug/papers algorithmic DoS prevention", () => {
+    it("escapes wildcard characters correctly in papers query endpoint", async () => {
+        const app = await createTestApp();
+        const env = createTestEnv();
+
+        queueSelectResponses([
+            { getResult: { id: "org-1", slug: "test" } },
+            { getResult: { id: "user-1", role: "admin" } },
+            { allResult: [] }
+        ]);
+
+        const res = await app.request(
+            "http://localhost/api/orgs/test/papers?venue=%25%5C_", // %\_
+            {},
+            env as any
+        );
+
+        expect(res.status).toBe(200);
+    });
+  });
 });

apps/api/src/routes/__tests__/papers.test.ts

@@ -2161,11 +2161,13 @@ describe("papers routes", () => {
     });
     const set = vi.fn().mockReturnThis();
     const where = vi.fn().mockReturnThis();
-    mockDb.select = vi.fn().mockImplementation(() =>
-      makeQuery({
-        getResult: { paperId: "paper-1", userId: "user-1", role: "uploader" },
-      }),
-    );
+    mockDb.select = vi
+      .fn()
+      .mockImplementation(() =>
+        makeQuery({
+          getResult: { paperId: "paper-1", userId: "user-1", role: "uploader" },
+        }),
+      );
     mockDb.update = vi.fn().mockImplementation(() => ({ set, where }) as any);
 
     const app = await createTestApp();
@@ -2209,11 +2211,13 @@ describe("papers routes", () => {
       githubId: "123",
       name: "Uploader",
     });
-    mockDb.select = vi.fn().mockImplementation(() =>
-      makeQuery({
-        getResult: { paperId: "paper-1", userId: "user-1", role: "uploader" },
-      }),
-    );
+    mockDb.select = vi
+      .fn()
+      .mockImplementation(() =>
+        makeQuery({
+          getResult: { paperId: "paper-1", userId: "user-1", role: "uploader" },
+        }),
+      );
 
     const app = await createTestApp();
     const env = createTestEnv();
@@ -2367,11 +2371,13 @@ describe("papers routes", () => {
     });
     const set = vi.fn().mockReturnThis();
     const where = vi.fn().mockReturnThis();
-    mockDb.select = vi.fn().mockImplementation(() =>
-      makeQuery({
-        getResult: { paperId: "paper-1", userId: "user-1", role: "uploader" },
-      }),
-    );
+    mockDb.select = vi
+      .fn()
+      .mockImplementation(() =>
+        makeQuery({
+          getResult: { paperId: "paper-1", userId: "user-1", role: "uploader" },
+        }),
+      );
     mockDb.update = vi.fn().mockImplementation(() => ({ set, where }) as any);
 
     const app = await createTestApp();
@@ -2417,11 +2423,13 @@ describe("papers routes", () => {
     });
     const set = vi.fn().mockReturnThis();
     const where = vi.fn().mockReturnThis();
-    mockDb.select = vi.fn().mockImplementation(() =>
-      makeQuery({
-        getResult: { paperId: "paper-1", userId: "user-1", role: "uploader" },
-      }),
-    );
+    mockDb.select = vi
+      .fn()
+      .mockImplementation(() =>
+        makeQuery({
+          getResult: { paperId: "paper-1", userId: "user-1", role: "uploader" },
+        }),
+      );
     mockDb.update = vi.fn().mockImplementation(() => ({ set, where }) as any);
 
     const app = await createTestApp();
@@ -2457,11 +2465,13 @@ describe("papers routes", () => {
     });
     const set = vi.fn().mockReturnThis();
     const where = vi.fn().mockReturnThis();
-    mockDb.select = vi.fn().mockImplementation(() =>
-      makeQuery({
-        getResult: { paperId: "paper-1", userId: "user-1", role: "uploader" },
-      }),
-    );
+    mockDb.select = vi
+      .fn()
+      .mockImplementation(() =>
+        makeQuery({
+          getResult: { paperId: "paper-1", userId: "user-1", role: "uploader" },
+        }),
+      );
     mockDb.update = vi.fn().mockImplementation(() => ({ set, where }) as any);
 
     const app = await createTestApp();
@@ -2495,11 +2505,13 @@ describe("papers routes", () => {
       githubId: "123",
       name: "Uploader",
     });
-    mockDb.select = vi.fn().mockImplementation(() =>
-      makeQuery({
-        getResult: { paperId: "paper-1", userId: "user-1", role: "uploader" },
-      }),
-    );
+    mockDb.select = vi
+      .fn()
+      .mockImplementation(() =>
+        makeQuery({
+          getResult: { paperId: "paper-1", userId: "user-1", role: "uploader" },
+        }),
+      );
 
     const app = await createTestApp();
     const env = createTestEnv();
@@ -2529,11 +2541,13 @@ describe("papers routes", () => {
     });
     const set = vi.fn().mockReturnThis();
     const where = vi.fn().mockReturnThis();
-    mockDb.select = vi.fn().mockImplementation(() =>
-      makeQuery({
-        getResult: { paperId: "paper-1", userId: "user-1", role: "uploader" },
-      }),
-    );
+    mockDb.select = vi
+      .fn()
+      .mockImplementation(() =>
+        makeQuery({
+          getResult: { paperId: "paper-1", userId: "user-1", role: "uploader" },
+        }),
+      );
     mockDb.update = vi.fn().mockImplementation(() => ({ set, where }) as any);
 
     const app = await createTestApp();
@@ -2569,11 +2583,13 @@ describe("papers routes", () => {
     });
     const set = vi.fn().mockReturnThis();
     const where = vi.fn().mockReturnThis();
-    mockDb.select = vi.fn().mockImplementation(() =>
-      makeQuery({
-        getResult: { paperId: "paper-1", userId: "user-1", role: "uploader" },
-      }),
-    );
+    mockDb.select = vi
+      .fn()
+      .mockImplementation(() =>
+        makeQuery({
+          getResult: { paperId: "paper-1", userId: "user-1", role: "uploader" },
+        }),
+      );
     mockDb.update = vi.fn().mockImplementation(() => ({ set, where }) as any);
 
     const app = await createTestApp();
@@ -2611,11 +2627,13 @@ describe("papers routes", () => {
     });
     const set = vi.fn().mockReturnThis();
     const where = vi.fn().mockReturnThis();
-    mockDb.select = vi.fn().mockImplementation(() =>
-      makeQuery({
-        getResult: { paperId: "paper-1", userId: "user-1", role: "uploader" },
-      }),
-    );
+    mockDb.select = vi
+      .fn()
+      .mockImplementation(() =>
+        makeQuery({
+          getResult: { paperId: "paper-1", userId: "user-1", role: "uploader" },
+        }),
+      );
     mockDb.update = vi.fn().mockImplementation(() => ({ set, where }) as any);
 
     const app = await createTestApp();
@@ -2651,11 +2669,13 @@ describe("papers routes", () => {
     });
     const set = vi.fn().mockReturnThis();
     const where = vi.fn().mockReturnThis();
-    mockDb.select = vi.fn().mockImplementation(() =>
-      makeQuery({
-        getResult: { paperId: "paper-1", userId: "user-1", role: "uploader" },
-      }),
-    );
+    mockDb.select = vi
+      .fn()
+      .mockImplementation(() =>
+        makeQuery({
+          getResult: { paperId: "paper-1", userId: "user-1", role: "uploader" },
+        }),
+      );
     mockDb.update = vi.fn().mockImplementation(() => ({ set, where }) as any);
 
     const app = await createTestApp();
@@ -2691,11 +2711,13 @@ describe("papers routes", () => {
     });
     const set = vi.fn().mockReturnThis();
     const where = vi.fn().mockReturnThis();
-    mockDb.select = vi.fn().mockImplementation(() =>
-      makeQuery({
-        getResult: { paperId: "paper-1", userId: "user-1", role: "uploader" },
-      }),
-    );
+    mockDb.select = vi
+      .fn()
+      .mockImplementation(() =>
+        makeQuery({
+          getResult: { paperId: "paper-1", userId: "user-1", role: "uploader" },
+        }),
+      );
     mockDb.update = vi.fn().mockImplementation(() => ({ set, where }) as any);
 
     const app = await createTestApp();
@@ -2739,11 +2761,13 @@ describe("papers routes", () => {
       githubId: "123",
       name: "Uploader",
     });
-    mockDb.select = vi.fn().mockImplementation(() =>
-      makeQuery({
-        getResult: { paperId: "paper-1", userId: "user-1", role: "uploader" },
-      }),
-    );
+    mockDb.select = vi
+      .fn()
+      .mockImplementation(() =>
+        makeQuery({
+          getResult: { paperId: "paper-1", userId: "user-1", role: "uploader" },
+        }),
+      );
 
     const app = await createTestApp();
     const env = createTestEnv();
@@ -2897,11 +2921,13 @@ describe("papers routes", () => {
     });
     const set = vi.fn().mockReturnThis();
     const where = vi.fn().mockReturnThis();
-    mockDb.select = vi.fn().mockImplementation(() =>
-      makeQuery({
-        getResult: { paperId: "paper-1", userId: "user-1", role: "uploader" },
-      }),
-    );
+    mockDb.select = vi
+      .fn()
+      .mockImplementation(() =>
+        makeQuery({
+          getResult: { paperId: "paper-1", userId: "user-1", role: "uploader" },
+        }),
+      );
     mockDb.update = vi.fn().mockImplementation(() => ({ set, where }) as any);
 
     const app = await createTestApp();
@@ -2940,11 +2966,13 @@ describe("papers routes", () => {
   });
 
   it("GET /api/papers/:id returns 401 for private paper without Bearer token", async () => {
-    mockDb.select = vi.fn().mockImplementationOnce(() =>
-      makeQuery({
-        getResult: { id: "paper-1", title: "P1", visibility: "private" },
-      }),
-    );
+    mockDb.select = vi
+      .fn()
+      .mockImplementationOnce(() =>
+        makeQuery({
+          getResult: { id: "paper-1", title: "P1", visibility: "private" },
+        }),
+      );
 
     const app = await createTestApp();
     const env = createTestEnv();
@@ -3201,6 +3229,7 @@ describe("papers routes", () => {
 
       expect(res.status).toBe(500);
     });
+
     it("POST /api/papers/:id/invites handles non-string non-Error rejections", async () => {
       const token = await createTestJWT({
         sub: "user-uploader",
@@ -3238,6 +3267,7 @@ describe("papers routes", () => {
 
       expect(res.status).toBe(500);
     });
+
   });
 });