Skip to content

Comments

[-]:fix/security alerts#1787

Merged
jaaaaavier merged 5 commits intomainfrom
fix/security-alerts
Feb 17, 2026
Merged

[-]:fix/security alerts#1787
jaaaaavier merged 5 commits intomainfrom
fix/security-alerts

Conversation

@jaaaaavier
Copy link
Contributor

This PR addresses multiple critical security vulnerabilities detected by CodeQL across the application:

  1. Server-Side Request Forgery (SSRF): Added strict type validation and sanitization (encodeURIComponent) to the temp-mail/get-message API parameters to prevent external URL manipulation.
  2. Path Injection: Implemented strict Regex validation (/^[a-z0-9-]+$/) in getServerSideProps (File Converter & Compressor) to prevent Directory Traversal attacks when loading dynamic JSON files.
  3. Clear Text Storage: Added Base64 encoding (btoa/atob) to prevent storing sensitive tokens in plain text within localStorage.

@jaaaaavier jaaaaavier self-assigned this Feb 17, 2026
@jaaaaavier jaaaaavier added the enhancement New feature or request label Feb 17, 2026
@vercel
Copy link

vercel bot commented Feb 17, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
website Ready Ready Preview, Comment Feb 17, 2026 11:46am

@sonarqubecloud
Copy link

Quality Gate Failed Quality Gate failed

Failed conditions
0.0% Coverage on New Code (required ≥ 80%)

See analysis details on SonarQube Cloud

@jaaaaavier jaaaaavier requested a review from xabg2 February 17, 2026 11:54
@jaaaaavier jaaaaavier merged commit 409481b into main Feb 17, 2026
9 of 10 checks passed
@jaaaaavier jaaaaavier deleted the fix/security-alerts branch February 17, 2026 15:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants