Martin Dvorak
8822baf4b7
Audit pass with the threats that actually apply to a self-hosted, account-less app: getting the Ollama key throttled or banned, and someone grinding the app down. Per-route windows already existed; these are the missing layers. - lib/model-guard.ts: every route that spends a model call now takes a slot — 60 calls per window across all clients (RATE_LIMIT_MODEL_TOTAL), 3 in flight per IP, 6 in total — and the slot is released when the call finishes, on errors and on client disconnects. Over the concurrency cap answers 429 kind=busy, not a punishment. Slots are taken after every cheap rejection so a malformed request cannot hold one (found by the new suite: early 400s were leaking slots). - Images must be base64 data URLs (dataUrlSchema in lib/schemas): a plain URL in an images field made Ollama fetch an arbitrary address on our behalf. - Push endpoints must be a real push service (PUSH_ALLOWED_HOSTS, defaulting to FCM/Mozilla/Apple/WNS): the server POSTs to whatever is stored. - The rate-limit identity is the LAST x-forwarded-for hop. Reading the first let a client spoof its own IP and dodge every per-IP limit. - Disk guards: reports.jsonl stops at REPORTS_MAX_BYTES (8 MB), reminder devices cap at PUSH_MAX_SUBSCRIPTIONS (50). - Security headers: frame-ancestors 'none' + X-Frame-Options DENY, nosniff, a referrer policy and a Permissions-Policy without camera/mic/geo/payment. New tests/security-test.mjs (13 checks, registered in run-all) proves each guard against a slow stub Ollama with deliberately tiny limits. README: security notes + rate-limit tables updated. Version 0.1.3, SW -> v51.
44 lines
1.2 KiB
JSON
44 lines
1.2 KiB
JSON
{
|
|
"name": "freezmo",
|
|
"version": "0.1.3",
|
|
"private": true,
|
|
"license": "GPL-3.0-only",
|
|
"scripts": {
|
|
"predev": "node scripts/copy-pdf-worker.mjs",
|
|
"dev": "next dev -H 0.0.0.0 -p 3207",
|
|
"prebuild": "node scripts/copy-pdf-worker.mjs",
|
|
"build": "next build",
|
|
"start": "next start -H 0.0.0.0 -p 3207",
|
|
"lint": "eslint",
|
|
"test:e2e": "node tests/run-all.mjs",
|
|
"version:bump": "node scripts/bump-version.mjs"
|
|
},
|
|
"dependencies": {
|
|
"canvas-confetti": "^1.9.4",
|
|
"framer-motion": "^12.23.24",
|
|
"jszip": "^3.10.2",
|
|
"katex": "^0.19.0",
|
|
"mammoth": "^1.13.0",
|
|
"next": "15.5.27",
|
|
"pdfjs-dist": "^6.4.299",
|
|
"react": "19.1.0",
|
|
"react-dom": "19.1.0",
|
|
"web-push": "^3.6.7",
|
|
"zod": "^4.1.13"
|
|
},
|
|
"devDependencies": {
|
|
"@eslint/eslintrc": "^3",
|
|
"@tailwindcss/postcss": "^4",
|
|
"@types/canvas-confetti": "^1.9.0",
|
|
"@types/node": "^20",
|
|
"@types/react": "^19",
|
|
"@types/react-dom": "^19",
|
|
"@types/web-push": "^3.6.4",
|
|
"axe-core": "^4.14.0",
|
|
"eslint": "^9",
|
|
"eslint-config-next": "15.5.27",
|
|
"playwright-core": "^1.64.0",
|
|
"tailwindcss": "^4",
|
|
"typescript": "^5"
|
|
}
|
|
}
|