fix(security): CodeQL findings — email injection, allocation DoS, cookie flags

backend/internal/api/auth.go

@@ -65,7 +65,7 @@ func (a *App) handleCallback(w http.ResponseWriter, r *http.Request) {
 		fail("store")
 		return
 	}
-	http.SetCookie(w, &http.Cookie{Name: auth.StateCookieName, Path: "/", MaxAge: -1})
+	http.SetCookie(w, a.Sessions.ClearStateCookie())
 
 	// CLI login: mint an API token and hand it back to the CLI's loopback
 	// listener instead of setting a browser session.

backend/internal/auth/session.go

@@ -181,6 +181,15 @@ func (s *Sessions) ClearCLICookie() *http.Cookie {
 	return &http.Cookie{Name: CLICookieName, Path: "/", MaxAge: -1, Secure: !s.devMode, HttpOnly: true}
 }
 
+// ClearStateCookie expires the OAuth state cookie with the same security flags
+// it was set with (HttpOnly, Secure in prod, SameSite=Lax).
+func (s *Sessions) ClearStateCookie() *http.Cookie {
+	return &http.Cookie{
+		Name: StateCookieName, Path: "/", MaxAge: -1,
+		Secure: !s.devMode, HttpOnly: true, SameSite: http.SameSiteLaxMode,
+	}
+}
+
 // VerifyState checks the OAuth state cookie against the state query parameter.
 func (s *Sessions) VerifyState(r *http.Request, state string) bool {
 	c, err := r.Cookie(StateCookieName)

backend/internal/email/email.go

@@ -5,11 +5,17 @@
 package email
 
 import (
+	"errors"
 	"fmt"
 	"log"
 	"net/smtp"
+	"strings"
 )
 
+// errHeaderInjection is returned when a header field contains a newline, which
+// could otherwise inject additional SMTP headers.
+var errHeaderInjection = errors.New("email: header field contains a newline")
+
 // Config holds the SMTP settings, all sourced from the environment.
 type Config struct {
 	Host string
@@ -41,6 +47,12 @@ func (s *Sender) Send(to, subject, body string) (sent bool, err error) {
 	if from == "" {
 		from = s.cfg.User
 	}
+	// Guard against SMTP header injection: a CR/LF in any header field (notably
+	// the user-supplied recipient) would let an attacker inject extra headers.
+	if strings.ContainsAny(to, "\r\n") || strings.ContainsAny(subject, "\r\n") ||
+		strings.ContainsAny(from, "\r\n") {
+		return false, errHeaderInjection
+	}
 	msg := []byte(fmt.Sprintf(
 		"From: %s\r\nTo: %s\r\nSubject: %s\r\nMIME-Version: 1.0\r\n"+
 			"Content-Type: text/plain; charset=UTF-8\r\n\r\n%s\r\n",

backend/internal/store/jsonstore.go

@@ -552,6 +552,9 @@ func (s *JSONStore) InstallSeries(short string, sinceDays int) []InstallPoint {
 	if sinceDays <= 0 {
 		sinceDays = 90
 	}
+	if sinceDays > 366 {
+		sinceDays = 366 // cap so an untrusted ?days= can't force a huge allocation
+	}
 	now := time.Now().UTC()
 	out := make([]InstallPoint, 0, sinceDays)
 	days := s.doc.Installs[short]

backend/internal/store/pebblestore.go

@@ -647,6 +647,9 @@ func (s *PebbleStore) InstallSeries(short string, sinceDays int) []InstallPoint
 	if sinceDays <= 0 {
 		sinceDays = 90
 	}
+	if sinceDays > 366 {
+		sinceDays = 366 // cap so an untrusted ?days= can't force a huge allocation
+	}
 	now := time.Now().UTC()
 	out := make([]InstallPoint, 0, sinceDays)
 	days := s.doc.Installs[short]