Ulas
3d2604bab9
Fix stored XSS in tasks (titles/subtasks) and settings (member list) by applying escHtml(). Harden trust proxy to loopback default, add OAuth state parameter for Google Calendar CSRF protection, sanitize CSV export against formula injection, invalidate sessions on user deletion, restrict usernames to alphanumeric chars, and require admin role for calendar sync triggers. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
43 lines
1.7 KiB
JSON
43 lines
1.7 KiB
JSON
{
|
|
"name": "oikos",
|
|
"version": "0.5.9",
|
|
"description": "Selbstgehosteter Familienplaner - Kalender, Aufgaben, Einkauf, Essensplan, Budget und mehr. Privat, offen, ohne Abo.",
|
|
"main": "server/index.js",
|
|
"engines": {
|
|
"node": ">=22.0.0"
|
|
},
|
|
"scripts": {
|
|
"start": "node server/index.js",
|
|
"dev": "node --watch server/index.js",
|
|
"setup": "node setup.js",
|
|
"test:db": "node --experimental-sqlite test-db.js",
|
|
"test:dashboard": "node --experimental-sqlite test-dashboard.js",
|
|
"test:tasks": "node --experimental-sqlite test-tasks.js",
|
|
"test:shopping": "node --experimental-sqlite test-shopping.js",
|
|
"test:meals": "node --experimental-sqlite test-meals.js",
|
|
"test:calendar": "node --experimental-sqlite test-calendar.js",
|
|
"test:ncb": "node --experimental-sqlite test-notes-contacts-budget.js",
|
|
"test:ux-utils": "node test-ux-utils.js",
|
|
"test:modal-utils": "node --loader ./test-browser-loader.mjs test-modal-utils.js",
|
|
"test": "node --experimental-sqlite test-db.js && node --experimental-sqlite test-dashboard.js && node --experimental-sqlite test-tasks.js && node --experimental-sqlite test-shopping.js && node --experimental-sqlite test-meals.js && node --experimental-sqlite test-calendar.js && node --experimental-sqlite test-notes-contacts-budget.js && npm run test:ux-utils && npm run test:modal-utils"
|
|
},
|
|
"dependencies": {
|
|
"bcrypt": "^5.1.1",
|
|
"better-sqlite3": "^9.6.0",
|
|
"dotenv": "^16.4.7",
|
|
"express": "^4.21.2",
|
|
"express-rate-limit": "^7.5.0",
|
|
"express-session": "^1.18.1",
|
|
"helmet": "^8.0.0",
|
|
"node-fetch": "^3.3.2"
|
|
},
|
|
"optionalDependencies": {
|
|
"googleapis": "^144.0.0",
|
|
"tsdav": "^2.0.10"
|
|
},
|
|
"license": "MIT",
|
|
"devDependencies": {
|
|
"sharp": "^0.34.5"
|
|
}
|
|
}
|