openclaw/oikos
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

feat: Phase 5 — Härtung (CSRF, Rate-Limit, Validation, Error Boundary, README)

Browse Source 
Schritt 28 — CSRF-Schutz (Double Submit Cookie Pattern):
- server/middleware/csrf.js: generiert 32-Byte-Token, speichert in Session + Cookie;
  validiert X-CSRF-Token-Header auf POST/PUT/PATCH/DELETE via timingSafeEqual
- server/auth.js: CSRF-Token beim Login erzeugen und als Cookie setzen
- public/api.js: getCsrfToken() liest Cookie; apiFetch() sendet Header auf
  state-ändernden Requests automatisch

Schritt 29 — Globaler Rate-Limiter:
- server/index.js: apiLimiter (300 req/min/IP) auf allen /api/-Routen;
  ergänzt den bestehenden loginLimiter (5 req/min)

Schritt 27 — Zentralisierte Eingabe-Validierung:
- server/middleware/validate.js: str(), oneOf(), date(), time(), num(), color(),
  collectErrors() mit einheitlichen Längengrenzen (MAX_TITLE=200, MAX_TEXT=5000)
- server/routes/tasks.js: validateTaskInput() nutzt nun validate.js

Schritt 31 — Frontend Error Boundary:
- public/router.js: window.onerror + unhandledrejection-Handler zeigen Toast

Schritt 33 — README.md:
- Setup-Anleitung (Docker + Node.js), Nginx-Config, User-Verwaltung,
  Umgebungsvariablen-Referenz, Backup, Sicherheitsübersicht

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
ulsklyc
2026-03-24 22:00:47 +01:00
parent 3903df6445
commit dd8ad80eb4
8 changed files with 437 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/routes/tasks.js
+12 -16
View File
@@ -9,7 +9,8 @@
const express = require('express');
const router = express.Router();
const db = require('../db');
const { nextOccurrence } = require('../services/recurrence');
const { nextOccurrence } = require('../services/recurrence');
const v = require('../middleware/validate');
// --------------------------------------------------------
// Konstanten
@@ -47,22 +48,17 @@ function subtaskProgress(taskId) {
return { total: row.total ?? 0, done: row.done ?? 0 };
}
/** Eingabe-Validierung für Task-Felder. */
/** Eingabe-Validierung für Task-Felder (zentralisiert über validate.js). */
function validateTaskInput(body, isCreate = true) {
const errors = [];
if (isCreate && !body.title?.trim()) errors.push('title ist erforderlich.');
if (body.title !== undefined && !body.title?.trim()) errors.push('title darf nicht leer sein.');
if (body.priority && !VALID_PRIORITIES.includes(body.priority))
errors.push(`priority muss eines von: ${VALID_PRIORITIES.join(', ')} sein.`);
if (body.status && !VALID_STATUSES.includes(body.status))
errors.push(`status muss eines von: ${VALID_STATUSES.join(', ')} sein.`);
if (body.category && !VALID_CATEGORIES.includes(body.category))
errors.push(`Ungültige Kategorie.`);
if (body.due_date && !/^\d{4}-\d{2}-\d{2}$/.test(body.due_date))
errors.push('due_date muss im Format YYYY-MM-DD sein.');
if (body.due_time && !/^\d{2}:\d{2}$/.test(body.due_time))
errors.push('due_time muss im Format HH:MM sein.');
return errors;
return v.collectErrors([
v.str(body.title, 'title', { required: isCreate }),
v.str(body.description, 'description', { required: false, max: v.MAX_TEXT }),
v.oneOf(body.priority, VALID_PRIORITIES, 'priority'),
v.oneOf(body.status, VALID_STATUSES, 'status'),
v.oneOf(body.category, VALID_CATEGORIES, 'category'),
v.date(body.due_date, 'due_date'),
v.time(body.due_time, 'due_time'),
]);
}
// --------------------------------------------------------