gsadmin/sencho
1
0
Fork 0
mirror of https://github.com/Studio-Saelix/sencho.git synced 2026-08-08 01:43:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): enforce stack name validation on all routes (#314)

Browse Source 
Audit found 11 routes with no stackName validation and 2 using a weaker
manual check. All 13 now use the canonical isValidStackName() guard
(^[a-zA-Z0-9_-]+$), returning 400 with { error: 'Invalid stack name' }.
This commit is contained in:
Anso
2026-04-01 19:43:11 -04:00
committed by GitHub
parent b9680d696d
commit 1ab04be235
4 changed files with 64 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/api-reference/overview.mdx
+13
View File
@@ -73,6 +73,19 @@ The `code` field is present for specific error types:
| `ADMIRAL_REQUIRED` | Endpoint requires an Admiral license |
| `SCOPE_DENIED` | API token scope does not allow this operation |
## Input validation
All endpoints that accept a `stackName` path parameter validate it against the pattern `^[a-zA-Z0-9_-]+$`. Stack names may only contain **alphanumeric characters, hyphens, and underscores**. Requests with invalid stack names are rejected immediately:
```json
// 400 Bad Request
{
"error": "Invalid stack name"
}
```
This applies to all stack endpoints: read, write, deploy, down, restart, stop, start, update, rollback, backup, delete, and container listing.
## Rate limiting
Authentication endpoints (`/api/auth/*`) are rate-limited to **5 requests per 15 minutes** in production. API token-authenticated requests are not rate-limited.