vincent/gerbeur
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

v3: fix the privacy and security findings of the comment pass — private dumps' broadcasts, mentions and attachments reached people who can't see them, and a few smaller holes. A dump's every write now goes through ws-service's broadcastDumpChange(before, after), which decides the audience: a private dump's creation, edits and deletion reach its owner's sockets alone (its deletion id went to everyone before), going private is dump_deleted for everyone else and dump_updated for the owner (whose other tabs dropped it), going public dump_created for everyone else. Mentions in a private dump, a comment on one, or a private playlist's description notify no one until it goes public (mentions are deduplicated per context, so going public notifies them once), and a moderator's edit of a comment, chat message or playlist mentions in the author's name. A link preview of a private playlist is refused, as one of a private dump already was: the preview is stored in the linking dump, which others may see. Attachments record the type of the resource that links them (migration 0018 backfills it); one linked by a private dump or playlist, or a comment on a private dump, is served only with its owner's media token, which Markdown now adds to attachment URLs, and one whose resource is gone answers 404 and is purged at startup. The Bandcamp provider claimed bandcamp.com.evil.example (the pattern wasn't anchored) and now reuses bandcamp-tralbum's anchored one; the YouTube provider took any site's ?list= for a YouTube playlist and missed m., music., youtube-nocookie and /live/ links, and now shares canonical-url's rules. Sign-in does the same scrypt work for an unknown username as for a wrong password, so timing no longer tells which exist. Usernames and emails are unique regardless of case (migration 0017, which refuses to run over existing clashes and names them): "Bob" and "bob" could both sign up and a mention picked one, emails had no constraint, and a reset request in another case silently sent nothing. The Open Graph tags escape the site name and build their URLs on PUBLIC_URL and FRONTEND_URL instead of the request's origin, which a proxy may rewrite.

Browse Source 
Error statuses follow one rule: APIException takes a status and derives the code from it (BAD_REQUEST 400, UNAUTHORIZED 401, FORBIDDEN 403, NOT_FOUND 404, CONFLICT 409, RATE_LIMITED 429, SERVER_ERROR 500, BAD_GATEWAY 502), so a code can't contradict its status. That fixed real bugs: a wrong current password on change-password answered 401, on which authFetch signs the user out; editing or deleting someone else's comment or chat message answered 401 rather than 403; one invalid dump edit answered 422. A taken username is 409, like a taken email.

Along the way: the database is created from schema.sql by connection.ts when the file doesn't exist, so every task works on a fresh checkout (dev and serve never ran db/init.ts, which is gone); the startup purge compared ISO dates with SQLite's datetime() as text and kept anything from the current UTC day, and now compares ISO cutoffs; the seeded admin's hash comes from lib/password.ts (split out of jwt.ts, which needs the JWT secret) rather than a copy of its format; avatar, thumbnail and playlist-cover uploads go through replaceUploadedFile, which writes beside the old file and renames over it before the record announces it (a failed avatar write lost the old avatar; a thumbnail was announced before it existed); upload.ts derives its size message from MAX_IMAGE_SIZE_BYTES and stops re-exporting the upload folders; ALLOWED_IMAGE_MIMES, which duplicated detectImageMime, is gone; the SPA fallback no longer calls next() after answering; a reply must answer a comment on the same dump (a foreign or unknown parent was a 500 or a cross-dump thread). 211 backend and 628 frontend tests pass.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
khannurien
2026-09-29 15:19:07 +00:00
parent 0d4e344d77
commit 14e3ab125b
69 changed files with 1011 additions and 1069 deletions
Download Patch File Download Diff File Expand all files Collapse all files

103
api/services/comment-service.ts
View File

@@ -6,7 +6,6 @@
* @module
*/
import { APIErrorCode } from "../../shared/api.ts";
import { APIException } from "../lib/api-exception.ts";
import type { Comment } from "../../shared/comment.ts";
import { type SQLOutputValue } from "node:sqlite";
@@ -29,14 +28,10 @@ function fetchComment(commentId: string): Comment {
`SELECT ${SELECT_COLS} FROM comments c JOIN users u ON c.user_id = u.id WHERE c.id = ?;`,
).get(commentId);
if (!row || !isCommentRow(row as Record<string, SQLOutputValue>)) {
throw new APIException(APIErrorCode.NOT_FOUND, 404, "Comment not found");
throw new APIException(404, "Comment not found");
}
if (!isCommentRow(row)) {
throw new APIException(
APIErrorCode.SERVER_ERROR,
500,
"Malformed comment data",
);
throw new APIException(500, "Malformed comment data");
}
return commentRowToApi(row);
}
@@ -52,7 +47,7 @@ export function getCommentDumpId(commentId: string): string {
commentId,
) as { dump_id: string } | undefined;
if (!row) {
throw new APIException(APIErrorCode.NOT_FOUND, 404, "Comment not found");
throw new APIException(404, "Comment not found");
}
return row.dump_id;
}
@@ -70,11 +65,7 @@ export function getComments(dumpId: string): Comment[] {
WHERE c.dump_id = ? ORDER BY c.created_at ASC;`,
).all(dumpId);
if (!rows.every(isCommentRow)) {
throw new APIException(
APIErrorCode.SERVER_ERROR,
500,
"Malformed comment data",
);
throw new APIException(500, "Malformed comment data");
}
return rows.map(commentRowToApi);
}
@@ -82,8 +73,11 @@ export function getComments(dumpId: string): Comment[] {
/**
* Posts a comment on dump `dumpId`, replying to `parentId` if given, for
* `POST /api/dumps/:dumpId/comments`. It notifies the dump's poster and the
* users it mentions, and links the comment's attachments and backlinks.
* `parentId` isn't checked to be a comment on the same dump.
* users it mentions, unless the dump is private, and links the comment's
* attachments and backlinks. The route has checked that the caller may see
* the dump.
*
* @throws {APIException} 400 when `parentId` isn't a comment on the same dump.
*/
export function createComment(
dumpId: string,
@@ -91,6 +85,13 @@ export function createComment(
body: string,
parentId?: string,
): Comment {
if (parentId !== undefined) {
const parent = db.prepare(`SELECT dump_id FROM comments WHERE id = ?;`)
.get(parentId) as { dump_id: string } | undefined;
if (parent?.dump_id !== dumpId) {
throw new APIException(400, "The comment replied to isn't on this dump");
}
}
const id = crypto.randomUUID();
const createdAt = new Date();
db.prepare(
@@ -104,24 +105,27 @@ export function createComment(
createdAt.toISOString(),
);
const comment = fetchComment(id);
const dumpRow = db.prepare(`SELECT title FROM dumps WHERE id = ?;`).get(
dumpId,
) as { title: string } | undefined;
const dumpRow = db.prepare(
`SELECT title, is_private FROM dumps WHERE id = ?;`,
).get(dumpId) as { title: string; is_private: number } | undefined;
notifyDumpOwnerNewComment(userId, id, dumpId);
notifyMentions(userId, body, "comment", id, dumpRow?.title ?? "", dumpId);
linkAttachments(body, id);
if (dumpRow && !dumpRow.is_private) {
notifyMentions(userId, body, "comment", id, dumpRow.title, dumpId);
}
linkAttachments(body, "comment", id);
relinkBacklinks("comment", id, dumpId, body);
return comment;
}
/**
* Replaces a comment's body, for `PATCH /api/comments/:commentId`.
* `canModerate` lets someone other than the author do it. It notifies the users
* it mentions for the first time and relinks the attachments and backlinks. The
* route broadcasts the comment unless `isPrivate`.
* `canModerate` lets someone other than the author do it. It notifies, in the
* author's name, the users it mentions for the first time, unless the dump is
* private, and relinks the attachments and backlinks. The route broadcasts the
* comment unless `isPrivate`.
*
* @throws {APIException} 404 when there is no such comment, 400 when it is
* deleted, 401 when the user is neither its author nor a moderator.
* deleted, 403 when the user is neither its author nor a moderator.
*/
export function updateComment(
commentId: string,
@@ -133,22 +137,14 @@ export function updateComment(
`SELECT c.dump_id, d.is_private FROM comments c JOIN dumps d ON c.dump_id = d.id WHERE c.id = ?;`,
).get(commentId) as { dump_id: string; is_private: number } | undefined;
if (!row) {
throw new APIException(APIErrorCode.NOT_FOUND, 404, "Comment not found");
throw new APIException(404, "Comment not found");
}
const existing = fetchComment(commentId);
if (existing.deleted) {
throw new APIException(
APIErrorCode.VALIDATION_ERROR,
400,
"Cannot edit a deleted comment",
);
throw new APIException(400, "Cannot edit a deleted comment");
}
if (existing.userId !== requestingUserId && !canModerate) {
throw new APIException(
APIErrorCode.UNAUTHORIZED,
401,
"Not authorized to edit this comment",
);
throw new APIException(403, "Not authorized to edit this comment");
}
const now = new Date().toISOString();
db.prepare(`UPDATE comments SET body = ?, updated_at = ? WHERE id = ?;`).run(
@@ -156,18 +152,21 @@ export function updateComment(
now,
commentId,
);
const dumpRow = db.prepare(`SELECT title FROM dumps WHERE id = ?;`).get(
row.dump_id,
) as { title: string } | undefined;
notifyMentions(
requestingUserId,
body,
"comment",
commentId,
dumpRow?.title ?? "",
row.dump_id,
);
linkAttachments(body, commentId);
if (!row.is_private) {
const dumpRow = db.prepare(`SELECT title FROM dumps WHERE id = ?;`).get(
row.dump_id,
) as { title: string } | undefined;
// A moderator's edit keeps the author's words, so the author mentions.
notifyMentions(
existing.userId,
body,
"comment",
commentId,
dumpRow?.title ?? "",
row.dump_id,
);
}
linkAttachments(body, "comment", commentId);
relinkBacklinks("comment", commentId, row.dump_id, body);
return {
comment: fetchComment(commentId),
@@ -182,7 +181,7 @@ export function updateComment(
* dropped, but the row stays so its replies keep their place. The route
* broadcasts the deletion unless `isPrivate`.
*
* @throws {APIException} 404 when there is no such comment, 401 when the user
* @throws {APIException} 404 when there is no such comment, 403 when the user
* is neither its author nor a moderator.
*/
export function deleteComment(
@@ -194,15 +193,11 @@ export function deleteComment(
`SELECT c.dump_id, d.is_private FROM comments c JOIN dumps d ON c.dump_id = d.id WHERE c.id = ?;`,
).get(commentId) as { dump_id: string; is_private: number } | undefined;
if (!row) {
throw new APIException(APIErrorCode.NOT_FOUND, 404, "Comment not found");
throw new APIException(404, "Comment not found");
}
const comment = fetchComment(commentId);
if (comment.userId !== requestingUserId && !canModerate) {
throw new APIException(
APIErrorCode.UNAUTHORIZED,
401,
"Not authorized to delete this comment",
);
throw new APIException(403, "Not authorized to delete this comment");
}
db.prepare(`UPDATE comments SET deleted = 1, body = '' WHERE id = ?;`).run(
commentId,