ClintchizandClaude Opus 5
c64434a131
Audit of 0.8.4 found the repo's own gates green, so these came from manual
review; each is covered by a new regression test.
security/fetch.ts
- safeFetch re-attached Authorization/Cookie on a same-origin redirect that
followed a cross-origin hop (a -> b -> b), handing credentials to the second
host. Compare against the origin the caller trusted, not the previous hop.
- The private-network guard resolved the host, approved it, then let fetch
resolve again, so a low-TTL record could answer public for the check and
private for the connection. Pin the connection to the validated address,
preserving Host and TLS serverName. Opt out with pinDns: false.
- 0:0:0:0:0:ffff:127.0.0.1, ::ffff:7f00:1 and fec0::1 were not treated as
private. Add uncompressed IPv4-mapped forms, site-local IPv6, 198.18/15
and 192.0.0/24.
security/url.ts
- sanitizeUrl returned "//evil.com" verbatim via the relative-path fast path,
bypassing the host checks it had just run; in an href that navigates
cross-origin. Resolve protocol-relative input instead.
dev-server/gateway.ts
- Malformed base64 in an Authorization header threw out of checkAuth on an
unauthenticated path. Fail closed.
- split(":", 2) truncated passwords at the first colon, so a password
containing ":" could never authenticate.
- The credential compare short-circuited on length mismatch, leaking length
by timing. Extracted as verifyBasicAuth so it is testable.
authz/index.ts
- Namespace wildcards only matched the first segment, so "post:comment:*"
did not grant "post:comment:delete". Match at every depth.
uploader/operations.ts
- Validate transcoder dimensions and bitrate rather than trusting the declared
type, and reject ".." path segments.
package.json
- The brace-expansion override pinned 5.0.8, which is inside the advisory
range >=4.0.0 <5.0.9. Bump to 5.0.9; bun audit is now clean.
Verified: check:production passes (typecheck, lint, 1033 tests, format,
ASVS, public-API baseline, editor checks).
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
88 lines
4.3 KiB
JSON
88 lines
4.3 KiB
JSON
{
|
|
"name": "wrnexus",
|
|
"version": "0.8.4",
|
|
"private": true,
|
|
"type": "module",
|
|
"description": "An SSR-first full-stack web framework with server-rendered reactive components. Bun-first, Node-friendly.",
|
|
"workspaces": [
|
|
"packages/*",
|
|
"examples/*",
|
|
"services/*"
|
|
],
|
|
"scripts": {
|
|
"dev": "bun run packages/cli/src/index.ts dev examples/basic-app",
|
|
"build": "bun run packages/cli/src/index.ts build examples/basic-app",
|
|
"create": "bun run packages/cli/src/index.ts create",
|
|
"example": "bun run dev",
|
|
"test": "bun test packages",
|
|
"test:examples": "bun test --preload ./scripts/fail-on-test-warnings.ts examples",
|
|
"check:example-pages": "bun run scripts/check-example-pages.ts",
|
|
"test:services": "bun test services",
|
|
"test:editor": "bun run --cwd editors/vscode test && bun run --cwd editors/vscode validate",
|
|
"check:editor-compiler": "node scripts/build-editor-compiler.mjs --check",
|
|
"check:editor-language-server": "node scripts/build-editor-language-server.mjs --check",
|
|
"check:editor-extension": "node scripts/build-editor-extension.mjs --check",
|
|
"test:all": "bun run test && bun run test:examples && bun run test:services && bun run test:editor",
|
|
"test:coverage": "bun test --coverage packages",
|
|
"security:audit": "bun audit",
|
|
"release:prepare": "bun run scripts/release.ts prepare",
|
|
"release:private": "bun run scripts/release.ts publish",
|
|
"test:db:live": "bash scripts/test-live-db.sh",
|
|
"typecheck": "tsc --noEmit",
|
|
"lint": "eslint .",
|
|
"lint:fix": "eslint . --fix",
|
|
"format": "prettier . --write",
|
|
"format:check": "prettier . --check",
|
|
"check": "bun run typecheck && bun run lint && bun run check:component-imports && bun run test && bun run format:check",
|
|
"verify:0.3": "node scripts/verify-0.3.mjs",
|
|
"verify:0.4": "node scripts/verify-0.4.mjs",
|
|
"validate:0.4": "node scripts/validate-0.4.mjs",
|
|
"auth:dev": "bun run --cwd examples/auth-showcase dev",
|
|
"auth:check": "bun run --cwd packages/auth check",
|
|
"validate:auth": "node scripts/validate-auth.mjs",
|
|
"validate:0.6": "node scripts/validate-0.6.mjs",
|
|
"validate:0.7": "node scripts/validate-0.7.mjs",
|
|
"security:framework": "node scripts/security-performance-audit.mjs",
|
|
"security:asvs": "node scripts/check-security-asvs.mjs",
|
|
"generate:security-report": "node scripts/security-performance-audit.mjs --write",
|
|
"check:public-api": "node scripts/check-public-api.mjs",
|
|
"generate:public-api": "node scripts/check-public-api.mjs --write",
|
|
"check:ui-visual": "node scripts/check-ui-visual-contract.mjs",
|
|
"generate:ui-visual": "node scripts/check-ui-visual-contract.mjs --write",
|
|
"sbom": "node scripts/generate-sbom.mjs",
|
|
"benchmark:framework": "node --experimental-transform-types scripts/benchmark-framework.mjs",
|
|
"check:production": "bun run check:workspace && bun run check:public-api && bun run check:ui-visual && bun run validate:0.8 && bun run security:framework && bun run security:asvs && bun run check:editor-compiler && bun run check:editor-language-server && bun run check:editor-extension && bun run check",
|
|
"validate:staging": "node --experimental-transform-types scripts/test-package-integrity.mjs",
|
|
"stage:packages": "bun run scripts/publish-packages.ts",
|
|
"test:staged-consumers": "node scripts/test-staged-consumers.mjs",
|
|
"repair:workspace": "node scripts/repair-workspace.mjs",
|
|
"test:workspace-repair": "node scripts/test-workspace-repair.mjs",
|
|
"check:workspace": "node scripts/repair-workspace.mjs --check",
|
|
"validate:0.8": "node scripts/validate-0.8.mjs",
|
|
"audit:packages": "node scripts/audit-package-kits.mjs",
|
|
"generate:package-audit": "node scripts/audit-package-kits.mjs --write",
|
|
"test:package-kits": "node --experimental-transform-types scripts/test-package-kits.mjs",
|
|
"check:component-imports": "node scripts/check-component-imports.mjs"
|
|
},
|
|
"devDependencies": {
|
|
"@eslint/js": "^10.0.1",
|
|
"@types/bun": "^1.3.14",
|
|
"eslint": "^10.8.0",
|
|
"happy-dom": "^20.11.1",
|
|
"prettier": "^3.9.6",
|
|
"tsup": "^8.5.1",
|
|
"typescript": "^5.9.3",
|
|
"typescript-eslint": "^8.65.0"
|
|
},
|
|
"engines": {
|
|
"bun": ">=1.3.0"
|
|
},
|
|
"overrides": {
|
|
"esbuild": "0.28.1",
|
|
"brace-expansion": "5.0.9"
|
|
},
|
|
"dependencies": {
|
|
"brace-expansion": "^5.0.9"
|
|
}
|
|
}
|