fix(security): comprehensive security hardening#2
Open
juliendoclot wants to merge 7 commits intoPAPAMICA:mainfrom
Open
fix(security): comprehensive security hardening#2juliendoclot wants to merge 7 commits intoPAPAMICA:mainfrom
juliendoclot wants to merge 7 commits intoPAPAMICA:mainfrom
Conversation
The Cloudflare account_id was hardcoded in the public repository. Replace with a comment instructing to use env var or CLI flag instead. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add centralized security module with: - SSRF protection: private IP detection, reserved hostname blocking, sync and async URL validation (with DNS resolution via Cloudflare DoH) - Rate limiter: per-endpoint configurable limits with deterministic cleanup - HTML escaping: prevent XSS in server-generated HTML - Header sanitization: reject CRLF injection in custom headers - Security response headers: CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add URL validation via quickValidateURL() to block requests to: - Private IP ranges (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) - Cloud metadata endpoints (169.254.169.254) - Reserved hostnames (localhost, *.local, *.internal) - Non-HTTP protocols - Numeric/hex IP obfuscation Protected endpoints: /api/check, /api/check-stream, /api/waf-detect, /api/http-manipulation, /api/security-headers, /api/dns-recon, /api/recon, /api/speedtest, /api/seo Also removes the weak 'secmy' domain filter. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…ty headers - Replace per-IP in-memory rate limiter with per-endpoint RateLimiter class with deterministic cleanup (replaces probabilistic Math.random() cleanup) - Add global rate limit guard for ALL /api/* endpoints (previously only /api/v1/) - Per-endpoint limits: check=10/min, stream=5/min, batch=3/min, recon=5/min, etc. - Add security headers to HTML responses: CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
reporting.ts: - Add escapeHtml() to all user-controlled data in HTML reports: session.url, wafDetection.wafType, evidence[], vuln.category, recommendations[], result.payload - Prevents XSS when opening generated HTML reports in browsers api.ts batch security: - Replace guessable job IDs (Date.now + Math.random) with crypto.randomUUID() - Add IP-based job ownership: only the creator can query/stop a job (403 otherwise) - Cap max 50 total jobs, 3 concurrent per IP - Reduce job retention from 24h to 1h - Apply SSRF validation to batch URLs via quickValidateURL() Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…older api.ts: - Replace local processCustomHeaders() with sanitizeCustomHeaders() from security module (rejects CRLF injection, limits to 20 headers) - Cap custom payloads to 500 total to prevent memory exhaustion - Cap streaming test requests to 10,000 max (prevents OOM with all encoding variations × methods × categories enabled) http-manipulation.ts: - Replace hardcoded 'evil.com' with 'waf-test.invalid' (RFC 6761 reserved TLD that is guaranteed to never resolve) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Security audit and hardening of waf-checker addressing critical vulnerabilities:
/api/v1/*was rate-limited. Now all/api/*endpoints have per-endpoint limits (e.g., check=10/min, batch=3/min, recon=5/min). Deterministic cleanup replaces probabilisticMath.random()approach.account_id: Cloudflareaccount_idwas hardcoded inwrangler.toml— replaced with env var instruction.session.url,wafDetection.wafType,evidence[],result.payload,vuln.category,recommendations[]) is now escaped withescapeHtml()before HTML insertion.Date.now + Math.random) replaced withcrypto.randomUUID(). IP-based ownership prevents cross-user job access (403). Max 50 jobs total, 3 per IP. Retention reduced from 24h to 1h.\r\n\0), limited to 20 per request. Custom payloads capped at 500. Streaming test requests capped at 10,000.evil.com(a real registered domain) withwaf-test.invalid(RFC 6761 reserved TLD).New file
app/src/security.ts— Centralized security utilities (SSRF validation, RateLimiter class, escapeHtml, header sanitization, security response headers)Modified files
app/src/api.ts— SSRF guards on all handlers, global rate limiting, batch hardening, input validation capsapp/src/reporting.ts— XSS escaping in HTML report generationapp/src/http-manipulation.ts— Safe host header placeholderapp/wrangler.toml— Remove exposed account_idTest plan
http://127.0.0.1,http://169.254.169.254,http://localhost→ 400 on all endpoints/api/checkwithin 60s → 429<script>alert(1)</script>in URL → escaped in output\r\n→ silently rejectedwrangler.tomlcontains noaccount_idevil.comno longer appears in codebasenpx tsc --noEmitpasses for modified files (pre-existing errors in batch.ts/http-manipulation.ts unchanged)🤖 Generated with Claude Code