wtclaude
e1461d9161
Address SonarQube security hotspots on the website: - server/src/app.js: replace `contentSecurityPolicy: false` with a helmet CSP tuned for the built React SPA (script-src 'self'; style-src adds 'unsafe-inline' for React inline styles + the Google Fonts stylesheet; font-src gstatic; img-src allows data:/https: for uploads, embedded body images and BRAND_* assets; connect-src 'self' for REST+SSE). upgrade-insecure-requests is intentionally omitted (TLS terminates at the proxy; keeps local `npm start` over http working). The /api/docs Swagger UI route gets a scoped looser policy (inline script/style) since swagger-ui-express injects an inline bootstrap. - client/vite.config.js: disable the inline module-preload polyfill so code-split builds keep `script-src 'self'` valid (RichTextEditor is a separate chunk). - bot/src/app.js, server/src/internalApp.js: disable x-powered-by on the two internal-only listeners (the public app already strips it via helmet). - shardEvents dedupe key: SHA-1 -> SHA-256 truncated to 40 hex chars (fits the existing CHAR(40) column, no migration; it is a content fingerprint, not a security value). schema.sql comment updated to match. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NgyHnrNa8WwG3doxvxjuCr
30 lines
1.3 KiB
JavaScript
30 lines
1.3 KiB
JavaScript
// Standalone Express app for server<->bot internal traffic. It is mounted on its
|
|
// OWN http listener (INTERNAL_PORT, default 3001) in server.js — an unpublished,
|
|
// compose-network-only port, mirroring how the bot exposes its internal API on
|
|
// 4100. Crucially it is NOT part of the public API app (app.js), so /internal/*
|
|
// (which returns the DECRYPTED Discord bot token) can never ride the same
|
|
// listener Pangolin proxies to the world. Shared-secret gated by
|
|
// requireInternalKey inside internal.routes. See issue #33.
|
|
const express = require('express')
|
|
|
|
const internalRouter = require('./router/v1/internal/internal.routes')
|
|
|
|
const internalApp = express()
|
|
|
|
// Internal-only listener, but don't advertise the stack anyway (defense in depth).
|
|
internalApp.disable('x-powered-by')
|
|
|
|
internalApp.use(express.json())
|
|
|
|
// Liveness probe for this listener (no secret required); mirrors the bot's
|
|
// /health on 4100. Useful for compose healthchecks without exposing anything.
|
|
internalApp.get('/health', (req, res) => res.json({ status: 'ok' }))
|
|
|
|
// requireInternalKey is applied inside internal.routes.
|
|
internalApp.use('/internal', internalRouter)
|
|
|
|
// Anything else on this listener is not a real internal route.
|
|
internalApp.use((req, res) => res.status(404).json({ message: 'Not found' }))
|
|
|
|
module.exports = internalApp
|