diff options
| author | Adam Soltys <[email protected]> | 2026-08-07 22:59:45 -0700 |
|---|---|---|
| committer | Adam Soltys <[email protected]> | 2026-08-07 23:29:25 -0700 |
| commit | 582eab0d3e78d3c92b3fbf2d41d1845ca5761387 (patch) | |
| tree | 3cb13c9698e2960c1b60071b0c3031952dbca46b | |
| parent | f9e8638b2443ebf2da2e11eb12d1a8d60bf7c9d6 (diff) | |
| download | coinos-server-582eab0d3e78d3c92b3fbf2d41d1845ca5761387.tar.gz coinos-server-582eab0d3e78d3c92b3fbf2d41d1845ca5761387.zip | |
upload: require auth on /upload/:type; bump sharp past libvips CVEs (S7)
POST /upload/:type fed the raw uploaded image straight into sharp with
no auth preValidation (unlike neighboring routes), reaching a native
libvips decoder in the container that holds the JWT secret and CLN hot
wallet. Require auth, and bump sharp 0.33.5 -> 0.35.3 (out of the
vulnerable < 0.35.0 libvips range, GHSA-f88m-g3jw-g9cj et al.).
Co-Authored-By: Claude Opus 4.8 <[email protected]>
| -rw-r--r-- | index.ts | 2 | ||||
| -rw-r--r-- | package.json | 2 |
2 files changed, 2 insertions, 2 deletions
@@ -131,7 +131,7 @@ app.post("/2fa", auth, users.enable2fa); app.post("/user", auth, users.update); app.post("/delete", auth, users.deleteSelf); app.post("/reset", optional, users.reset); -app.post("/upload/:type", users.upload); +app.post("/upload/:type", auth, users.upload); app.get("/users/delete/:username", users.del); app.post("/acl", users.acl); app.post("/superuser", users.superuser); diff --git a/package.json b/package.json index 1cf2b00a..2ddf5241 100644 --- a/package.json +++ b/package.json @@ -45,7 +45,7 @@ "ramda": "^0.30.1", "readable-stream-clone": "^0.0.7", "redis": "^4.7.1", - "sharp": "^0.33.5", + "sharp": "^0.35.3", "square": "^43.2.1", "strfry-rpc": "^0.0.1", "uuid": "^11.1.1", |