mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-08-07 17:34:23 +00:00
Anso
4e5ba17710
* refactor(backend): sanitize user input before logging to close CRLF injection
Adds a small sanitizeForLog helper that strips CR, LF, tab, and ASCII
control characters (0x00-0x1F, 0x7F) from a value before it is embedded
in a console.log/warn/error/debug call. Wraps every call site where a
user-controlled value (req.params, req.body, req.query, or a value
derived from them) flows into a log message.
Closes the bulk of the open CodeQL alerts in this family:
- 96 js/log-injection
- 28 js/tainted-format-string
The helper is in backend/src/utils/safeLog.ts. Routes still pre-validate
input at the request boundary; this is the second line of defense and
gives static analyzers a sanitizer they can trace through. JSON
responses, Docker filter labels, and other non-log call sites are
intentionally left unwrapped.
* refactor(backend): printf-style format strings for tainted-log call sites
CodeQL's js/tainted-format-string rule flags template literals in the first
arg of console.X when any interpolated value is user-controlled, regardless
of whether each value is sanitized inline. The canonical mitigation is to
use a static format string and pass values as positional args.
Converts the 28 flagged template literals to printf-style ("%s") format
strings, with sanitizeForLog applied to each positional arg. Also fills in
the log-injection wraps on 9 sites where a user-controlled value was
missed in the first sweep (agents, fleet, gitSources, imageUpdates,
GitSourceService).
No behavior change at runtime. Node's util.format substitutes %s tokens
identically to template-literal interpolation.
* fix(backend): wrap nodeId/snapshotId in fleet restore debug log
CodeQL flagged the unwrapped numeric args even though they cannot
contain control chars in practice. Apply the sanitizer for taint-flow
recognition.
63 lines
2.2 KiB
TypeScript
63 lines
2.2 KiB
TypeScript
import type { Request, Response, NextFunction, RequestHandler } from 'express';
|
|
import { DatabaseService } from '../services/DatabaseService';
|
|
import { isDebugEnabled } from '../utils/debug';
|
|
import { getAuditSummary } from '../utils/audit-summaries';
|
|
import { sanitizeForLog } from '../utils/safeLog';
|
|
import { WEBHOOK_TRIGGER_RE } from '../helpers/routePatterns';
|
|
import { authMiddleware } from './auth';
|
|
|
|
/**
|
|
* `/api/*` auth gate. Mounted at `/api`, so paths it sees are already
|
|
* stripped of the `/api` prefix. Exempts `/auth/*` (setup, login, SSO:
|
|
* handled by their own routes) and webhook triggers (authenticated via
|
|
* HMAC, not session).
|
|
*/
|
|
export const authGate: RequestHandler = (req: Request, res: Response, next: NextFunction): void => {
|
|
if (req.path.startsWith('/auth/') || WEBHOOK_TRIGGER_RE.test(req.path)) {
|
|
next();
|
|
return;
|
|
}
|
|
authMiddleware(req, res, next);
|
|
};
|
|
|
|
/**
|
|
* Audit-logging middleware. Records every mutating `/api/*` action for
|
|
* Admiral accountability. Mounted at `/api`. Uses `res.on('finish')` to
|
|
* capture the final status code.
|
|
*/
|
|
export const auditLog: RequestHandler = (req: Request, res: Response, next: NextFunction): void => {
|
|
if (!['POST', 'PUT', 'DELETE', 'PATCH'].includes(req.method)) {
|
|
next();
|
|
return;
|
|
}
|
|
|
|
const username = req.user?.username || 'unknown';
|
|
const nodeId = req.nodeId ?? null;
|
|
const forwarded = req.headers['x-forwarded-for'];
|
|
const xff = typeof forwarded === 'string' ? forwarded.split(',')[0].trim() : '';
|
|
const ip = req.ip || xff || '';
|
|
const apiPath = req.path;
|
|
|
|
res.on('finish', () => {
|
|
try {
|
|
if (isDebugEnabled()) {
|
|
console.log(`[Audit:diag] ${sanitizeForLog(req.method)} /api${sanitizeForLog(apiPath)} by=${sanitizeForLog(username)} status=${res.statusCode} node=${nodeId ?? 'local'} ip=${sanitizeForLog(ip)}`);
|
|
}
|
|
DatabaseService.getInstance().insertAuditLog({
|
|
timestamp: Date.now(),
|
|
username,
|
|
method: req.method,
|
|
path: `/api${apiPath}`,
|
|
status_code: res.statusCode,
|
|
node_id: nodeId,
|
|
ip_address: ip,
|
|
summary: getAuditSummary(req.method, apiPath),
|
|
});
|
|
} catch (err) {
|
|
console.error('[Audit] Failed to write audit log:', err);
|
|
}
|
|
});
|
|
|
|
next();
|
|
};
|