Mehboob Khan
28d0addfc0
Some checks failed
CI / build (push) Has been cancelled
Fixes the two High-severity findings from Isaac Hague's 19/08/2026 review (F-01, F-02) plus F-03 through F-09: - F-01: content writes are now sanitised server-side (sanitize-html) as the real security boundary — the browser-side sanitiser is UX, not enforcement, and a direct API write bypassed it entirely. Also closes the javascript: href gap in sanitiseInline(). - F-02: refusing the factory admin password no longer depends on NODE_ENV; it's the unconditional default now, with an explicit ALLOW_DEV_PASSWORD=1 opt-in for local dev. - F-03: adds CSP (report-only — the legacy inline onclick="" handlers would break under enforcement) and HSTS, in both server/index.mjs and vercel.json. - F-04/F-05: rate-limits /api/leads and rotates leads.jsonl past 5MB; CSV export neutralises leading =+-@ so exports can't carry live formulas. - F-06: sessions drop from 12h to 4h and are tied to a per-boot random epoch, so a restart now actually revokes outstanding tokens. - F-07/F-08/F-09: generic messages on 5xx, fixed-length password comparison (no more length disclosure via the short-circuit), periodic throttle-map cleanup. F-10 (dependency advisories): applied the two non-breaking patches (nanoid, postcss); the vite/react-router-dom major bumps are left for a separate pass, per the report's own recommendation. F-11 (PDF Content-Disposition) and a CAPTCHA/honeypot on the enquiry form are deliberately left open — both are product/UX calls, not pure security fixes. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
31 lines
825 B
JSON
31 lines
825 B
JSON
{
|
|
"name": "blackdice-website-react",
|
|
"private": true,
|
|
"version": "1.0.0",
|
|
"type": "module",
|
|
"scripts": {
|
|
"dev": "node scripts/dev.mjs",
|
|
"dev:web": "vite",
|
|
"dev:api": "node server/index.mjs",
|
|
"build": "tsc --noEmit && node scripts/generate-sitemap.mjs && vite build",
|
|
"start": "node server/index.mjs",
|
|
"preview": "vite preview",
|
|
"cms:ids": "node scripts/inject-cms-ids.mjs",
|
|
"cms:import": "node scripts/seed-content.mjs"
|
|
},
|
|
"dependencies": {
|
|
"framer-motion": "^11.18.2",
|
|
"react": "^18.3.1",
|
|
"react-dom": "^18.3.1",
|
|
"react-router-dom": "^6.26.2",
|
|
"sanitize-html": "^2.17.7"
|
|
},
|
|
"devDependencies": {
|
|
"@types/react": "^18.3.5",
|
|
"@types/react-dom": "^18.3.0",
|
|
"@vitejs/plugin-react": "^4.3.1",
|
|
"typescript": "^5.5.3",
|
|
"vite": "^5.4.2"
|
|
}
|
|
}
|