5c7066b7d3
Critical fixes: - helmet middleware (X-Frame-Options, HSTS, X-Content-Type, CSP, etc) - Remove /admin from PUBLIC_PREFIXES (double auth: session + admin role) - Session cookie: httpOnly, sameSite=lax, 1-day expiry (was 30 days) - Session regeneration on login (prevent session fixation) - Blocked user check on login Rate limiting: - /auth/login: 10 req / 15 min (brute force protection) - /auth/register: 10 req / 15 min (spam protection) - /parse, /metadata, /text, /preview: 20 req / min (DDoS via server) Input sanitization: - Strip HTML tags from display_name (stored XSS prevention)
41 lines
992 B
JSON
Executable File
41 lines
992 B
JSON
Executable File
{
|
|
"name": "tinypng",
|
|
"version": "1.0.0",
|
|
"main": "server.js",
|
|
"scripts": {
|
|
"test": "echo \"Error: no test specified\" && exit 1",
|
|
"start": "node server.js"
|
|
},
|
|
"keywords": [],
|
|
"author": "",
|
|
"license": "ISC",
|
|
"type": "commonjs",
|
|
"description": "",
|
|
"dependencies": {
|
|
"@adminjs/express": "^6.1.1",
|
|
"@adminjs/sequelize": "^4.1.1",
|
|
"@adminjs/sql": "^2.2.6",
|
|
"@mozilla/readability": "^0.6.0",
|
|
"adminjs": "^7.8.17",
|
|
"archiver": "^7.0.1",
|
|
"bcrypt": "^6.0.0",
|
|
"dotenv": "^17.3.1",
|
|
"express": "^5.1.0",
|
|
"express-formidable": "^1.2.0",
|
|
"express-rate-limit": "^8.3.0",
|
|
"express-session": "^1.18.1",
|
|
"geoip-lite": "^1.4.10",
|
|
"helmet": "^8.1.0",
|
|
"iconv-lite": "^0.7.2",
|
|
"jsdom": "^28.1.0",
|
|
"mariadb": "^3.5.2",
|
|
"multer": "^1.4.5-lts.2",
|
|
"mysql2": "^3.20.0",
|
|
"openid-client": "^6.4.2",
|
|
"opentype.js": "^1.3.4",
|
|
"passport": "^0.7.0",
|
|
"sequelize": "^6.37.8",
|
|
"sharp": "^0.34.1"
|
|
}
|
|
}
|