olemd/favoritter
1
0
Fork 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions

fix: address security and quality issues from code review

Browse source 
Security fixes:
- Fix XSS in Atom feed: escape user-supplied URLs in HTML content
- Wrap signup request approval in a transaction to prevent
  partial state on crash (user created but request still pending)
- Stop leaking internal error messages to admin UI
- Add request body size limit on API import endpoint
- Log SetMustResetPassword errors instead of silently discarding

Correctness fixes:
- Handle errors from API fave update/delete instead of returning
  success on failure
- Use actual data timestamp for feed <updated> instead of
  time.Now() (improves HTTP caching)
- Replace hardcoded 10000 export limit with named constant
  (maxExportFaves = 100000)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Ole-Morten Duesund 2026-03-29 16:19:44 +02:00
commit 395b1b7523
5 changed files with 63 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

6
internal/handler/import_export.go
View file

@ -15,6 +15,8 @@ import (
"kode.naiv.no/olemd/favoritter/internal/render"
)
const maxExportFaves = 100000
// ExportFave is the JSON representation for export/import.
type ExportFave struct {
Description string `json:"description"`
@ -35,7 +37,7 @@ func (h *Handler) handleExportPage(w http.ResponseWriter, r *http.Request) {
func (h *Handler) handleExportJSON(w http.ResponseWriter, r *http.Request) {
user := middleware.UserFromContext(r.Context())
faves, _, err := h.deps.Faves.ListByUser(user.ID, 10000, 0)
faves, _, err := h.deps.Faves.ListByUser(user.ID, maxExportFaves, 0)
if err != nil {
slog.Error("export: list faves error", "error", err)
http.Error(w, "Internal error", http.StatusInternalServerError)
@ -72,7 +74,7 @@ func (h *Handler) handleExportJSON(w http.ResponseWriter, r *http.Request) {
func (h *Handler) handleExportCSV(w http.ResponseWriter, r *http.Request) {
user := middleware.UserFromContext(r.Context())
faves, _, err := h.deps.Faves.ListByUser(user.ID, 10000, 0)
faves, _, err := h.deps.Faves.ListByUser(user.ID, maxExportFaves, 0)
if err != nil {
slog.Error("export: list faves error", "error", err)
http.Error(w, "Internal error", http.StatusInternalServerError)