From 582eab0d3e78d3c92b3fbf2d41d1845ca5761387 Mon Sep 17 00:00:00 2001 From: Adam Soltys Date: Fri, 7 Aug 2026 22:59:45 -0700 Subject: upload: require auth on /upload/:type; bump sharp past libvips CVEs (S7) POST /upload/:type fed the raw uploaded image straight into sharp with no auth preValidation (unlike neighboring routes), reaching a native libvips decoder in the container that holds the JWT secret and CLN hot wallet. Require auth, and bump sharp 0.33.5 -> 0.35.3 (out of the vulnerable < 0.35.0 libvips range, GHSA-f88m-g3jw-g9cj et al.). Co-Authored-By: Claude Opus 4.8 --- index.ts | 2 +- package.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/index.ts b/index.ts index 5f468454..f607ecb8 100644 --- a/index.ts +++ b/index.ts @@ -131,7 +131,7 @@ app.post("/2fa", auth, users.enable2fa); app.post("/user", auth, users.update); app.post("/delete", auth, users.deleteSelf); app.post("/reset", optional, users.reset); -app.post("/upload/:type", users.upload); +app.post("/upload/:type", auth, users.upload); app.get("/users/delete/:username", users.del); app.post("/acl", users.acl); app.post("/superuser", users.superuser); diff --git a/package.json b/package.json index 1cf2b00a..2ddf5241 100644 --- a/package.json +++ b/package.json @@ -45,7 +45,7 @@ "ramda": "^0.30.1", "readable-stream-clone": "^0.0.7", "redis": "^4.7.1", - "sharp": "^0.33.5", + "sharp": "^0.35.3", "square": "^43.2.1", "strfry-rpc": "^0.0.1", "uuid": "^11.1.1", -- cgit v1.2.3