Johannes Millan fd6499f138 fix(security): address critical and high severity vulnerabilities ... Security fixes implemented: 1. CRITICAL: Fix missing await in email verification (pages.ts:139) - verifyEmail() was called without await, causing race condition - Response was sent before verification completed 2. CRITICAL: Fix XSS vulnerability in password reset page (pages.ts) - Added safeJsonForScript() to properly escape tokens in JS context - JSON.stringify alone doesn't escape </script> sequences - Now escapes <, >, & as unicode (\u003c, \u003e, \u0026) 3. CRITICAL: Fix XSS in privacy HTML template (server.ts) - Added escapeHtml() function for all template interpolations - Prevents XSS if environment variables contain malicious content 4. HIGH: Enable Content Security Policy (server.ts) - CSP was disabled (contentSecurityPolicy: false) - Now enabled with strict directives: - default-src 'self', object-src 'none', frame-ancestors 'none' 5. HIGH: Block wildcard CORS in production (config.ts) - CORS_ORIGINS=* with credentials is a security vulnerability - Now throws error in production, warns in development 6. HIGH: Add password reset flow (auth.ts, api.ts, email.ts, schema.prisma) - Secure token generation with crypto.randomBytes(32) - 1-hour expiry, one-time use tokens - Revokes all sessions on password reset - Prevents email enumeration (same response for all cases) - Rate limited: 5 requests/15min for forgot-password - Rate limited: 10 requests/15min for reset-password Test coverage: - 45 new tests across 4 test files - Tests for XSS prevention, CORS blocking, CSP headers - Tests for password reset flow (API and unit level) - Fixed pre-existing flaky boundary test in retention-config.spec.ts		2025-12-31 12:15:56 +01:00
..
migrations	fix(security): address critical and high severity vulnerabilities	2025-12-31 12:15:56 +01:00
schema.prisma	fix(security): address critical and high severity vulnerabilities	2025-12-31 12:15:56 +01:00