Ryan/Reactive-Resume
1
0
Fork 0
mirror of https://github.com/AmruthPillai/Reactive-Resume.git synced 2026-07-26 01:44:53 +10:00
Code Issues Packages Projects Releases Wiki Activity

feat(security): harden auth, oauth, and printer endpoints

Browse Source 
Add stricter URL and redirect validation, endpoint rate limiting, safer defaults for printer and compose config, and CSP protections across server and API surfaces.

Made-with: Cursor
This commit is contained in:
Amruth Pillai
2026-04-25 15:31:06 +02:00
parent d3102565e4
commit a42dbcd452
27 changed files with 1041 additions and 376 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pnpm-lock.yaml
Generated
+47 -24
View File
@@ -80,6 +80,9 @@ importers:
'@orpc/client':
specifier: ^1.14.0
version: 1.14.0(@opentelemetry/api@1.9.0)
'@orpc/experimental-ratelimit':
specifier: ^1.14.0
version: 1.14.0(@opentelemetry/api@1.9.0)(crossws@0.4.5(srvx@0.11.15))(ws@8.20.0)
'@orpc/json-schema':
specifier: ^1.14.0
version: 1.14.0(@opentelemetry/api@1.9.0)(crossws@0.4.5(srvx@0.11.15))(ws@8.20.0)
@@ -91,7 +94,7 @@ importers:
version: 1.14.0(@opentelemetry/api@1.9.0)(crossws@0.4.5(srvx@0.11.15))(ws@8.20.0)
'@orpc/tanstack-query':
specifier: ^1.14.0
version: 1.14.0(@opentelemetry/api@1.9.0)(@orpc/client@1.14.0(@opentelemetry/api@1.9.0))(@tanstack/query-core@5.100.1)
version: 1.14.0(@opentelemetry/api@1.9.0)(@orpc/client@1.14.0(@opentelemetry/api@1.9.0))(@tanstack/query-core@5.100.2)
'@orpc/zod':
specifier: ^1.14.0
version: 1.14.0(@opentelemetry/api@1.9.0)(@orpc/contract@1.14.0(@opentelemetry/api@1.9.0))(@orpc/server@1.14.0(@opentelemetry/api@1.9.0)(crossws@0.4.5(srvx@0.11.15))(ws@8.20.0))(crossws@0.4.5(srvx@0.11.15))(ws@8.20.0)(zod@4.3.6)
@@ -108,14 +111,14 @@ importers:
specifier: ^0.13.11
version: 0.13.11(zod@4.3.6)
'@tanstack/react-query':
specifier: ^5.100.1
version: 5.100.1(react@19.2.5)
specifier: ^5.100.2
version: 5.100.2(react@19.2.5)
'@tanstack/react-router':
specifier: ^1.168.24
version: 1.168.24(react-dom@19.2.5(react@19.2.5))(react@19.2.5)
'@tanstack/react-router-ssr-query':
specifier: ^1.166.11
version: 1.166.11(@tanstack/query-core@5.100.1)(@tanstack/react-query@5.100.1(react@19.2.5))(@tanstack/react-router@1.168.24(react-dom@19.2.5(react@19.2.5))(react@19.2.5))(@tanstack/router-core@1.168.16)(react-dom@19.2.5(react@19.2.5))(react@19.2.5)
version: 1.166.11(@tanstack/query-core@5.100.2)(@tanstack/react-query@5.100.2(react@19.2.5))(@tanstack/react-router@1.168.24(react-dom@19.2.5(react@19.2.5))(react@19.2.5))(@tanstack/router-core@1.168.16)(react-dom@19.2.5(react@19.2.5))(react@19.2.5)
'@tanstack/react-start':
specifier: ^1.167.48
version: 1.167.48(@voidzero-dev/vite-plus-core@0.1.19(@types/node@25.6.0)(esbuild@0.27.7)(jiti@2.6.1)(terser@5.46.2)(tsx@4.21.0)(yaml@2.8.3))(crossws@0.4.5(srvx@0.11.15))(react-dom@19.2.5(react@19.2.5))(react@19.2.5)
@@ -240,8 +243,8 @@ importers:
specifier: ^4.0.3
version: 4.0.3(react-dom@19.2.5(react@19.2.5))(react@19.2.5)
shadcn:
specifier: ^4.4.0
version: 4.4.0(@types/node@25.6.0)(babel-plugin-macros@3.1.0)
specifier: ^4.5.0
version: 4.5.0(@types/node@25.6.0)(babel-plugin-macros@3.1.0)
sharp:
specifier: ^0.34.5
version: 0.34.5
@@ -2080,6 +2083,14 @@ packages:
'@orpc/contract@1.14.0':
resolution: {integrity: sha512-FUxBNqWr6mOjI+w1JPzO/iHmR3M+GA53ivaxp+eOnQu7g3ZGKB0RS5gJ/oz3cGF1gvuIcCw9FVYKK/5tkB8I1Q==}
'@orpc/experimental-ratelimit@1.14.0':
resolution: {integrity: sha512-9RuGjwcyP8IYKEzjpYYTA7vbDNfrOdEIKBkkgB3MZoRoMajA/xv+CApqbkwpGbJa+I8UeZdnPjZ42PKZA/qVag==}
peerDependencies:
'@upstash/ratelimit': '>=2.0.7'
peerDependenciesMeta:
'@upstash/ratelimit':
optional: true
'@orpc/interop@1.14.0':
resolution: {integrity: sha512-T4z8ehjks4rP8Z4XDObHBQjFiH61Wz8HlDaW4SR+GK0+u3h4l3+Fdwwxvm7ZWtY2zJEraqhaJhEHf90W7w50fA==}
@@ -3445,11 +3456,11 @@ packages:
resolution: {integrity: sha512-NaOGLRrddszbQj9upGat6HG/4TKvXLvu+osAIgfxPYA+eIvYKv8GKDJOrY2D3/U9MRnKfMWD7bU4jeD4xmqyIg==}
engines: {node: '>=20.19'}
'@tanstack/query-core@5.100.1':
resolution: {integrity: sha512-awvQhOO/2TrSCHE5LKKsXcvvj6WSBncwEcMFCB/ez0Qs0b17iyyivoGArNV3HFfXryZwCpnb/olsaBBKrIbtSw==}
'@tanstack/query-core@5.100.2':
resolution: {integrity: sha512-HzzOC7xgSfGGzZ1gTsFZqYz6rxGg3tYF77nTPctin+wEYYLNMP7LjwPVFALEGNdjxkHvcewh1EM5ywixeukS4w==}
'@tanstack/react-query@5.100.1':
resolution: {integrity: sha512-UgWRLhQKprC37SsO6y1zRabOqDmM2gsdTNPbqTT35yl7kOOhwXU4nyfOiGHXPwoEFJV1IpSk85hjIFjNFWVpzw==}
'@tanstack/react-query@5.100.2':
resolution: {integrity: sha512-MvvzPcurtzVh4EcbsTfI1BL5GOfdi1S0dk/qhigEghW07MvcHUl/dhfc1FT8hPEquuMtUC+IIAxC0bdmSp/7kA==}
peerDependencies:
react: ^18 || ^19
@@ -6851,8 +6862,8 @@ packages:
setprototypeof@1.2.0:
resolution: {integrity: sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==}
shadcn@4.4.0:
resolution: {integrity: sha512-0V1AjVktKwhK1e0ONXb9SeBoyJePH04iTSJeMjl9eROqjjyb8OoWYtWDI39UdBU3GzpUlFBJFohhB9c6fGOkQA==}
shadcn@4.5.0:
resolution: {integrity: sha512-ZpNOz7IMI5aezbMEWNxBvl2aJ1ek6NuAMqpL/FUnk5IuRxERl8ohYEnqqAmhPOcur8RbGuCoqTZLQ3Oi4Xkf8A==}
hasBin: true
sharp@0.34.5:
@@ -9694,6 +9705,18 @@ snapshots:
transitivePeerDependencies:
- '@opentelemetry/api'
'@orpc/experimental-ratelimit@1.14.0(@opentelemetry/api@1.9.0)(crossws@0.4.5(srvx@0.11.15))(ws@8.20.0)':
dependencies:
'@orpc/client': 1.14.0(@opentelemetry/api@1.9.0)
'@orpc/server': 1.14.0(@opentelemetry/api@1.9.0)(crossws@0.4.5(srvx@0.11.15))(ws@8.20.0)
'@orpc/shared': 1.14.0(@opentelemetry/api@1.9.0)
'@orpc/standard-server': 1.14.0(@opentelemetry/api@1.9.0)
transitivePeerDependencies:
- '@opentelemetry/api'
- crossws
- fastify
- ws
'@orpc/interop@1.14.0': {}
'@orpc/json-schema@1.14.0(@opentelemetry/api@1.9.0)(crossws@0.4.5(srvx@0.11.15))(ws@8.20.0)':
@@ -9808,11 +9831,11 @@ snapshots:
transitivePeerDependencies:
- '@opentelemetry/api'
'@orpc/tanstack-query@1.14.0(@opentelemetry/api@1.9.0)(@orpc/client@1.14.0(@opentelemetry/api@1.9.0))(@tanstack/query-core@5.100.1)':
'@orpc/tanstack-query@1.14.0(@opentelemetry/api@1.9.0)(@orpc/client@1.14.0(@opentelemetry/api@1.9.0))(@tanstack/query-core@5.100.2)':
dependencies:
'@orpc/client': 1.14.0(@opentelemetry/api@1.9.0)
'@orpc/shared': 1.14.0(@opentelemetry/api@1.9.0)
'@tanstack/query-core': 5.100.1
'@tanstack/query-core': 5.100.2
transitivePeerDependencies:
- '@opentelemetry/api'
@@ -10934,19 +10957,19 @@ snapshots:
'@tanstack/history@1.161.6': {}
'@tanstack/query-core@5.100.1': {}
'@tanstack/query-core@5.100.2': {}
'@tanstack/react-query@5.100.1(react@19.2.5)':
'@tanstack/react-query@5.100.2(react@19.2.5)':
dependencies:
'@tanstack/query-core': 5.100.1
'@tanstack/query-core': 5.100.2
react: 19.2.5
'@tanstack/react-router-ssr-query@1.166.11(@tanstack/query-core@5.100.1)(@tanstack/react-query@5.100.1(react@19.2.5))(@tanstack/react-router@1.168.24(react-dom@19.2.5(react@19.2.5))(react@19.2.5))(@tanstack/router-core@1.168.16)(react-dom@19.2.5(react@19.2.5))(react@19.2.5)':
'@tanstack/react-router-ssr-query@1.166.11(@tanstack/query-core@5.100.2)(@tanstack/react-query@5.100.2(react@19.2.5))(@tanstack/react-router@1.168.24(react-dom@19.2.5(react@19.2.5))(react@19.2.5))(@tanstack/router-core@1.168.16)(react-dom@19.2.5(react@19.2.5))(react@19.2.5)':
dependencies:
'@tanstack/query-core': 5.100.1
'@tanstack/react-query': 5.100.1(react@19.2.5)
'@tanstack/query-core': 5.100.2
'@tanstack/react-query': 5.100.2(react@19.2.5)
'@tanstack/react-router': 1.168.24(react-dom@19.2.5(react@19.2.5))(react@19.2.5)
'@tanstack/router-ssr-query-core': 1.167.1(@tanstack/query-core@5.100.1)(@tanstack/router-core@1.168.16)
'@tanstack/router-ssr-query-core': 1.167.1(@tanstack/query-core@5.100.2)(@tanstack/router-core@1.168.16)
react: 19.2.5
react-dom: 19.2.5(react@19.2.5)
transitivePeerDependencies:
@@ -11074,9 +11097,9 @@ snapshots:
transitivePeerDependencies:
- supports-color
'@tanstack/router-ssr-query-core@1.167.1(@tanstack/query-core@5.100.1)(@tanstack/router-core@1.168.16)':
'@tanstack/router-ssr-query-core@1.167.1(@tanstack/query-core@5.100.2)(@tanstack/router-core@1.168.16)':
dependencies:
'@tanstack/query-core': 5.100.1
'@tanstack/query-core': 5.100.2
'@tanstack/router-core': 1.168.16
'@tanstack/router-utils@1.161.7':
@@ -14401,7 +14424,7 @@ snapshots:
setprototypeof@1.2.0: {}
shadcn@4.4.0(@types/node@25.6.0)(babel-plugin-macros@3.1.0):
shadcn@4.5.0(@types/node@25.6.0)(babel-plugin-macros@3.1.0):
dependencies:
'@babel/core': 7.29.0
'@babel/parser': 7.29.2