mirror of
https://github.com/UNITRONIX/BetterDesk.git
synced 2026-09-11 13:49:03 +00:00
Knienartowicz
de53408803
Node.js (web-nodejs):
- H-02 (services/brandingService.js): tighten SVG sanitization (strip <style>/<use>/<image>, DOCTYPE/PI, CSS expression()/@import); export validateBrandingUrl() rejecting protocol-relative // and unknown schemes
- H-03 (routes/settings.routes.js): logo upload — whitelist /^logo-[0-9a-f]{16}.(png|jpg|jpeg|gif|webp|svg)$/i + path.resolve prefix check + fs.lstatSync symlink guard before deleting old logo
Go server (betterdesk-server):
- H-04 (auth/recovery.go NEW): TOTP recovery codes — GenerateRecoveryCodes (10 codes XXXX-XXXX-XX, unambiguous alphabet), HashRecoveryCodes (JSON array of bcrypt hashes, cost 10), ConsumeRecoveryCode (single-use, returns updated store)
- H-04 (db/database.go,sqlite.go,postgres.go): User.TOTPRecoveryCodes field with read/write via COALESCE-tolerant SELECTs (additive, backward-compat: column already existed from Phase 12 migration)
- H-04 (api/auth_handlers.go): handleConfirmTOTP returns plaintext recovery codes ONCE on enable; handleLogin2FA falls back to ConsumeRecoveryCode on invalid TOTP and audits with 2fa=recovery_code; handleDisableTOTP clears stored codes
Scripts:
- H-05 (betterdesk.sh): replace curl|bash piping with download-to-tempfile + validation — HTTPS-only (--proto=https --tlsv1.2), size sanity (1-500KB), shebang sanity check, SHA-256 logged, optional pinning via NODESOURCE_SHA256 env
Verification: go build ./... ✓, go vet ./... ✓ (exit 0), go test ./auth/... ./db/... ✓, jest 102/102 passed
This commit was made possible thanks to Insolve.