Add security hardening and improve logging practices#1
Open
filipvlcekk wants to merge 2 commits intoATechAjay:mainfrom
Open
Add security hardening and improve logging practices#1filipvlcekk wants to merge 2 commits intoATechAjay:mainfrom
filipvlcekk wants to merge 2 commits intoATechAjay:mainfrom
Conversation
Address 10 security findings from comprehensive audit: - [HIGH] Add SSRF protection: validate Ollama URLs in all API routes to block private IPs, cloud metadata endpoints, and non-http protocols - [MEDIUM-HIGH] Add security headers (X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) via next.config.ts - [MEDIUM] Validate Ollama URL format in settings store before persisting - [MEDIUM] Add 50MB file size limit to upload component - [MEDIUM] Remove module-level state leak (lastExtractedText) in pdfParser - [MEDIUM] Replace all console.log/warn with dev-only debugLog/debugWarn utility to prevent financial data exposure in production - [LOW-MEDIUM] Add try-catch around JSON.parse in review page - [LOW] Remove unused deps (rehype-raw, file-saver, html2canvas, jspdf, tesseract.js) — rehype-raw was an XSS risk if ever imported - [LOW] Change Ollama CORS instructions from wildcard to localhost:3000 - [LOW] Disable formula/HTML/style parsing in xlsx for safer Excel handling https://claude.ai/code/session_01VxaHB5v67Q2yhuipdHsGp6
|
@claude is attempting to deploy a commit to the atechajay's projects Team on Vercel. A member of the Team first needs to authorize it. |
- Move validateAndSelectFile above useCallback hooks in FileUpload.tsx to fix "accessed before declaration" error, wrap it in useCallback - Change let to const for allTransactions in parse/route.ts and llmParser.ts - Remove unused eslint-disable directive in llmParser.ts - Remove unused 'get' parameter in settingsStore.ts https://claude.ai/code/session_01VxaHB5v67Q2yhuipdHsGp6
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR implements comprehensive security hardening measures and improves logging practices across the application. Key improvements include SSRF attack prevention for Ollama URLs, security headers configuration, input validation, and environment-aware logging to prevent sensitive data leakage in production.
Key Changes
Security Enhancements
validateOllamaUrl()function to sanitize Ollama URLs, blocking private/internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16) and cloud metadata endpoints while allowing localhostsetOllamaUrl()in settings store with protocol validation and trailing slash normalizationLogging Improvements
debugLog()anddebugWarn()utilities that only output in development mode, preventing sensitive data leakage in productionconsole.log()andconsole.warn()calls with debug utilities across PDF, CSV, XLS, and LLM parsing moduleslastExtractedTextglobal variable andgetLastExtractedText()export that could expose sensitive financial dataAPI Endpoint Hardening
Dependency Cleanup
file-saver,html2canvas,jspdf,tesseract.js,rehype-raw, and their type definitionsImplementation Details
NODE_ENVenvironment variable for automatic suppression in production buildshttps://claude.ai/code/session_01VxaHB5v67Q2yhuipdHsGp6