fix: address CodeQL security findings (v0.5.2)

- Rate-limit SPA fallback route (missing rate limiting on fs access)
- Add csrfMiddleware to all state-changing auth routes (logout, create
  user, change password, delete user) — previously bypassed global CSRF
  middleware due to router registration order
- Fix incomplete vCard escaping: escape backslashes before other special
  characters to prevent injection via contact fields
- Restrict CI GITHUB_TOKEN to contents: read (least privilege)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

This commit is contained in:

Ulas

2026-04-01 18:30:03 +02:00

parent b9b81a461e

commit 91c2e0ad98

6 changed files with 30 additions and 8 deletions

									
										.github/workflows/ci.yml
									
		+3
		
												View File
												
				@@ -6,6 +6,9 @@ on:

				  pull_request:

				    branches: [main]

				permissions:

				  contents: read

				jobs:

				  test:

				    name: Tests (Node.js ${{ matrix.node-version }})