Buriburizaemon/nodewarden
1
0
Fork 0
mirror of https://github.com/shuaiplus/nodewarden.git synced 2026-06-20 13:00:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: clean up security scan warnings

Browse Source
This commit is contained in:
shuaiplus
2026-03-12 02:18:14 +08:00
parent 246a743822
commit cc522ec40f
3 changed files with 29 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/security.yml
+17 -11
View File
@@ -19,7 +19,7 @@ jobs:
env: env:
SECURITY_SNYK_TOKEN: ${{ secrets.SECURITY_SNYK_TOKEN }} SECURITY_SNYK_TOKEN: ${{ secrets.SECURITY_SNYK_TOKEN }}
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v5
with: with:
fetch-depth: 0 fetch-depth: 0
@@ -40,15 +40,21 @@ jobs:
upload: true upload: true
output: sarif-results output: sarif-results
- name: Secret Detection - name: Install Gitleaks
id: gitleaks if: env.ACT != 'true'
uses: gitleaks/gitleaks-action@dcedce43c6f43de0b836d1fe38946645c9c638dc
continue-on-error: true continue-on-error: true
env: run: |
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GITLEAKS_VERSION="8.28.0"
with: curl -sSL -o gitleaks.tar.gz "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
format: sarif tar -xzf gitleaks.tar.gz gitleaks
report_path: results.sarif chmod +x gitleaks
sudo mv gitleaks /usr/local/bin/gitleaks
- name: Secret Detection
if: env.ACT != 'true'
continue-on-error: true
run: |
gitleaks git . --report-format sarif --report-path results.sarif --no-banner || true
- name: Install Project Dependencies - name: Install Project Dependencies
if: env.SECURITY_SNYK_TOKEN != '' if: env.SECURITY_SNYK_TOKEN != ''
@@ -114,7 +120,7 @@ jobs:
cat security-report-cn.md >> $GITHUB_STEP_SUMMARY cat security-report-cn.md >> $GITHUB_STEP_SUMMARY
- name: Upload Gitleaks Results to GitHub Security - name: Upload Gitleaks Results to GitHub Security
uses: github/codeql-action/upload-sarif@v3 uses: github/codeql-action/upload-sarif@v4
if: always() if: always()
with: with:
sarif_file: results.sarif sarif_file: results.sarif
@@ -122,7 +128,7 @@ jobs:
- name: Upload Security Report Artifacts - name: Upload Security Report Artifacts
if: always() if: always()
uses: actions/upload-artifact@v4 uses: actions/upload-artifact@v6
with: with:
name: security-report name: security-report
if-no-files-found: ignore if-no-files-found: ignore
src/handlers/accounts.ts
+10 -1
View File
@@ -46,7 +46,16 @@ function validateKdfParams(kdfType: number | undefined, kdfIterations: number |
} }
function normalizeTotpSecret(input: string): string { function normalizeTotpSecret(input: string): string {
return input.toUpperCase().replace(/[\s-]/g, '').replace(/=+$/g, ''); const raw = String(input || '').toUpperCase();
let out = '';
for (const char of raw) {
if (char === ' ' || char === '\t' || char === '\n' || char === '\r' || char === '-') continue;
out += char;
}
while (out.endsWith('=')) {
out = out.slice(0, -1);
}
return out;
} }
function normalizeRecoveryCodeInput(input: string): string { function normalizeRecoveryCodeInput(input: string): string {
webapp/src/App.tsx
+2 -1
View File
@@ -1811,7 +1811,8 @@ export default function App() {
const hashPathRaw = typeof window !== 'undefined' ? window.location.hash || '' : ''; const hashPathRaw = typeof window !== 'undefined' ? window.location.hash || '' : '';
const hashPath = hashPathRaw.startsWith('#') ? hashPathRaw.slice(1) : hashPathRaw; const hashPath = hashPathRaw.startsWith('#') ? hashPathRaw.slice(1) : hashPathRaw;
const hashPathOnly = String(hashPath || '').split('?')[0].split('#')[0]; const hashPathOnly = String(hashPath || '').split('?')[0].split('#')[0];
const normalizedHashPath = `/${hashPathOnly.replace(/^\/+/, '').replace(/\/+$/, '')}`.replace(/^\/$/, '/'); const trimmedHashPath = hashPathOnly.replace(/^\/+/, '').replace(/\/+$/, '');
const normalizedHashPath = trimmedHashPath ? `/${trimmedHashPath}` : '/';
const isImportHashRoute = IMPORT_ROUTE_ALIASES.has(normalizedHashPath); const isImportHashRoute = IMPORT_ROUTE_ALIASES.has(normalizedHashPath);
const effectiveLocation = hashPath.startsWith('/send/') || hashPath === '/recover-2fa' ? hashPath : location; const effectiveLocation = hashPath.startsWith('/send/') || hashPath === '/recover-2fa' ? hashPath : location;
const publicSendMatch = effectiveLocation.match(/^\/send\/([^/]+)(?:\/([^/]+))?\/?$/i); const publicSendMatch = effectiveLocation.match(/^\/send\/([^/]+)(?:\/([^/]+))?\/?$/i);