screentinker/frontend/js/utils.js at 281a735e8430c1c59a1049718a64c6e6b06d65c3 - Archive/screentinker - Chris' Git

Archive/screentinker

mirror of https://github.com/screentinker/screentinker.git synced 2026-05-15 07:32:23 -06:00

ScreenTinker afbe113acf Security audit remediation: auth, IDOR, XSS, hardening

- Device WebSocket authentication: devices get a device_token on
  registration, must present it on reconnect. All WS events require
  prior auth. Timing-safe token comparison.
- IDOR fixes: ownership checks on schedules (device, week), layouts
  (all CRUD, zones, duplicate, device assign), video-walls (content,
  device-config).
- XSS prevention: shared esc() helper in utils.js, fixed 13 innerHTML
  injection points across 9 frontend files.
- OAuth hardening: no longer silently overwrites auth_provider on
  accounts with local passwords (returns 409).
- JWT pinned to HS256 for sign and verify.
- Password policy: change endpoint now requires 8 chars (was 6).
- HSTS header enabled (max-age 1 year, includeSubDomains).
- Stripe webhook rejects unsigned payloads when no secret configured.
- Screenshot size validation (max 2MB base64).
- Rate limiting on exports, imports, content operations.
- Content file serving checks playlist_items instead of old assignments.
- Content ownership verified in device-groups assign-content.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-04-11 22:48:07 -05:00

6 lines

269 B

JavaScript

Raw Blame History

 // HTML escape helper — prevents XSS when inserting user data into innerHTML
 export function esc(str) {
   if (str == null) return '';
   return String(str).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;').replace(/'/g,'&#39;');
 }