From e1461d9161e3ad9595a0f662676744a030eae433 Mon Sep 17 00:00:00 2001
From: wtclaude <claude@whitlocktech.net>
Date: Mon, 20 Jul 2026 23:02:11 -0500
Subject: [PATCH] fix(security): add SPA CSP, drop x-powered-by, strengthen
 dedupe hash

Address SonarQube security hotspots on the website:

- server/src/app.js: replace `contentSecurityPolicy: false` with a helmet CSP
  tuned for the built React SPA (script-src 'self'; style-src adds 'unsafe-inline'
  for React inline styles + the Google Fonts stylesheet; font-src gstatic; img-src
  allows data:/https: for uploads, embedded body images and BRAND_* assets;
  connect-src 'self' for REST+SSE). upgrade-insecure-requests is intentionally
  omitted (TLS terminates at the proxy; keeps local `npm start` over http working).
  The /api/docs Swagger UI route gets a scoped looser policy (inline script/style)
  since swagger-ui-express injects an inline bootstrap.
- client/vite.config.js: disable the inline module-preload polyfill so code-split
  builds keep `script-src 'self'` valid (RichTextEditor is a separate chunk).
- bot/src/app.js, server/src/internalApp.js: disable x-powered-by on the two
  internal-only listeners (the public app already strips it via helmet).
- shardEvents dedupe key: SHA-1 -> SHA-256 truncated to 40 hex chars (fits the
  existing CHAR(40) column, no migration; it is a content fingerprint, not a
  security value). schema.sql comment updated to match.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NgyHnrNa8WwG3doxvxjuCr
---
 bot/src/app.js                                |  3 ++
 client/vite.config.js                         |  4 ++
 server/db/schema.sql                          |  5 +-
 server/src/app.js                             | 46 +++++++++++++++++--
 server/src/internalApp.js                     |  3 ++
 .../model/shardEvents/shardEvents.model.js    | 13 ++++--
 6 files changed, 65 insertions(+), 9 deletions(-)

diff --git a/bot/src/app.js b/bot/src/app.js
index 1029d90..c69dab3 100644
--- a/bot/src/app.js
+++ b/bot/src/app.js
@@ -4,6 +4,9 @@ const internalRouter = require('./internal/internal.routes')
 
 const app = express()
 
+// Internal-only listener, but don't advertise the stack anyway (defense in depth).
+app.disable('x-powered-by')
+
 app.use(express.json())
 
 app.get('/health', (req, res) => res.json({ status: 'ok' }))
diff --git a/client/vite.config.js b/client/vite.config.js
index 46b418f..38ee91b 100644
--- a/client/vite.config.js
+++ b/client/vite.config.js
@@ -15,5 +15,9 @@ export default defineConfig({
   },
   build: {
     outDir: 'dist',
+    // Don't inject the inline module-preload polyfill script — modern browsers all
+    // support modulepreload, and an inline <script> would violate the server's
+    // `script-src 'self'` CSP (see server/src/app.js). Keeps builds inline-free.
+    modulePreload: { polyfill: false },
   },
 })
diff --git a/server/db/schema.sql b/server/db/schema.sql
index 7b3c50b..07a5122 100644
--- a/server/db/schema.sql
+++ b/server/db/schema.sql
@@ -333,8 +333,9 @@ CREATE TABLE IF NOT EXISTS uo_link_config (
 -- IDOC transitions, quests, skill.gain, fame/karma, audit.*, cheat.*, link.*,
 -- server.*). High-frequency kinds (char.vitals, economy.supply) are NOT logged
 -- here — they update shard_online / shard_economy instead, keeping the log lean.
--- dedupe_key = sha1(kind + t + stable-json(payload)); with the UNIQUE index it
--- makes INSERT IGNORE idempotent so WS-reconnect backfill never double-inserts.
+-- dedupe_key = sha256(kind + t + stable-json(payload)) truncated to 40 hex chars
+-- (fits CHAR(40)); with the UNIQUE index it makes INSERT IGNORE idempotent so
+-- WS-reconnect backfill never double-inserts.
 CREATE TABLE IF NOT EXISTS shard_events (
   id          BIGINT AUTO_INCREMENT PRIMARY KEY,
   kind        VARCHAR(48)  NOT NULL,
diff --git a/server/src/app.js b/server/src/app.js
index 69020b1..38ded53 100644
--- a/server/src/app.js
+++ b/server/src/app.js
@@ -36,11 +36,38 @@ app.use(trustProxyDebug)
 // obvious scanner probes are 404'd immediately without reaching real handlers.
 app.use(botScore.guard)
 
-// Security headers. CSP is left off here and will be tuned for the React SPA in
-// the frontend phase; the rest of helmet's protections stay enabled.
+// Security headers, including a Content-Security-Policy tuned for the built React
+// SPA. Notes on each non-'self' allowance:
+//   • style-src 'unsafe-inline' — React renders pervasive inline `style={{…}}`
+//     attributes, and CSP style *attributes* cannot be nonce'd; this is required.
+//     Also whitelists the Google Fonts stylesheet host.
+//   • font-src — Google Fonts (Cinzel) serves the font files from gstatic.
+//   • img-src https:/data: — uploaded images are same-origin, but wiki/news bodies
+//     (sanitizeHtml allows <img> over http/https) and BRAND_* logo/hero/favicon may
+//     point at external https images. http images are blocked by mixed-content on
+//     the https site anyway.
+//   • connect-src 'self' — the REST API and SSE streams are same-origin.
+//   • upgrade-insecure-requests is intentionally dropped: TLS is terminated at the
+//     proxy, there are no mixed-content subresources to upgrade, and leaving it on
+//     breaks a local `npm start` served over plain http.
+// The interactive API docs at /api/docs get their own looser policy below.
 app.use(
   helmet({
-    contentSecurityPolicy: false,
+    contentSecurityPolicy: {
+      useDefaults: true,
+      directives: {
+        'default-src': ["'self'"],
+        'script-src': ["'self'"],
+        'style-src': ["'self'", "'unsafe-inline'", 'https://fonts.googleapis.com'],
+        'font-src': ["'self'", 'https://fonts.gstatic.com'],
+        'img-src': ["'self'", 'data:', 'https:'],
+        'connect-src': ["'self'"],
+        'frame-ancestors': ["'self'"],
+        'object-src': ["'none'"],
+        'base-uri': ["'self'"],
+        'upgrade-insecure-requests': null,
+      },
+    },
     crossOriginResourcePolicy: { policy: 'cross-origin' },
   }),
 )
@@ -123,7 +150,18 @@ try {
     // #swagger.ignore = true
     res.json(swaggerSpec)
   })
-  app.use('/api/docs', swaggerUi.serve, swaggerUi.setup(swaggerSpec, {
+  // swagger-ui-express injects an inline bootstrap script and inline styles, which
+  // the global 'self'-only script-src would block — relax CSP for this route only.
+  const swaggerCsp = helmet.contentSecurityPolicy({
+    useDefaults: true,
+    directives: {
+      'script-src': ["'self'", "'unsafe-inline'"],
+      'style-src': ["'self'", "'unsafe-inline'"],
+      'img-src': ["'self'", 'data:', 'https:'],
+      'upgrade-insecure-requests': null,
+    },
+  })
+  app.use('/api/docs', swaggerCsp, swaggerUi.serve, swaggerUi.setup(swaggerSpec, {
     customSiteTitle: `${brand.name} API docs`,
     swaggerOptions: { persistAuthorization: true },
   }))
diff --git a/server/src/internalApp.js b/server/src/internalApp.js
index 7e9cd39..efc7a89 100644
--- a/server/src/internalApp.js
+++ b/server/src/internalApp.js
@@ -11,6 +11,9 @@ const internalRouter = require('./router/v1/internal/internal.routes')
 
 const internalApp = express()
 
+// Internal-only listener, but don't advertise the stack anyway (defense in depth).
+internalApp.disable('x-powered-by')
+
 internalApp.use(express.json())
 
 // Liveness probe for this listener (no secret required); mirrors the bot's
diff --git a/server/src/model/shardEvents/shardEvents.model.js b/server/src/model/shardEvents/shardEvents.model.js
index 1518204..a45dacc 100644
--- a/server/src/model/shardEvents/shardEvents.model.js
+++ b/server/src/model/shardEvents/shardEvents.model.js
@@ -18,10 +18,17 @@ function stableStringify(value) {
   return `{${keys.map((k) => `${JSON.stringify(k)}:${stableStringify(value[k])}`).join(',')}}`
 }
 
-// dedupe_key = sha1(kind + t + stable-json(payload)). Two identical events (same
-// kind, same timestamp, same body) collapse to one row.
+// dedupe_key = sha256(kind + t + stable-json(payload)), truncated to 40 hex chars.
+// This is a content fingerprint for idempotent INSERT IGNORE, not a security value,
+// but we use SHA-256 rather than SHA-1 anyway; the truncation keeps it inside the
+// CHAR(40) column (160 bits is ample collision resistance for dedupe). Two identical
+// events (same kind, same timestamp, same body) collapse to one row.
 function dedupeKey(kind, t, payload) {
-  return crypto.createHash('sha1').update(`${kind}|${t}|${stableStringify(payload)}`).digest('hex')
+  return crypto
+    .createHash('sha256')
+    .update(`${kind}|${t}|${stableStringify(payload)}`)
+    .digest('hex')
+    .slice(0, 40)
 }
 
 // Append one event. Returns true if a new row was inserted (false = deduped).