27 lines
2.1 KiB
Markdown
27 lines
2.1 KiB
Markdown
# wishlist — triage (group D)
|
|
Pin: ghcr.io/cmintey/wishlist:v0.67.1. Gates: setup_gate + signup_block (/signup) + app sign-up switch closed by command.
|
|
|
|
## release:cmintey/wishlist@v0.69.0 — REAL, app security fixes + Node runtime
|
|
Read the PR diffs:
|
|
- PR #818 "remove reset token exposure": in v0.67.1 `src/routes/forgot-password/+page.server.ts` the form action creates
|
|
a reset token for ANY existing e-mail and RETURNS it in the action result (`return { success: true, token }`). The
|
|
action runs whether or not SMTP is enabled (only the page UI hides the form). A stranger who knows/guesses a user's
|
|
e-mail POSTs to /forgot-password and receives the token -> /reset-password -> account takeover (admin included).
|
|
Severity: CRITICAL (my rating; no GHSA published yet). Login: none. Reachable: YES — after the setup gate opens the
|
|
app is public; signup_block covers only /signup. (Read from source, not tested live.)
|
|
- PR #817 "validate list ownership on modifying APIs": any logged-in user could PATCH other users' lists/items (IDOR).
|
|
Medium; login: any user.
|
|
- PR #832 admin "clear sessions" action was not implemented. Low; admin.
|
|
- Node.js Oct 2026 CVEs (base node:24-slim re-pinned, PR #829). Runtime; SvelteKit node adapter does not inflate bodies.
|
|
## release:cmintey/wishlist@v0.68.0 "nodemailer v10 [SECURITY]" — NOT-A-FINDING
|
|
GHSA-6vj9-mwq6-2f5v: process-global DNS cache leaks TLS servername across multiple SMTPS transports (multi-tenant).
|
|
Wishlist uses one transport; our template sets no SMTP. Fixed anyway by the target.
|
|
|
|
## Fix / target
|
|
Smallest fix = TARGET: `ghcr.io/cmintey/wishlist:v0.69.0` (ghcr tag exists; `v` prefix matches pin). Same main: yes (0).
|
|
Breaking: none found (read v0.68.0, v0.69.0): entrypoint now `exec node build` (still runs migrate+seed+db:patch first);
|
|
pnpm 12 via corepack; prisma migrations auto; manager/owner permission semantics changed (#819). Our healthcheck/command
|
|
need only `node` + node:sqlite — still present (node:24-slim).
|
|
Lane: SECURITY_FIX — urgent.
|
|
Classifier note: the v0.69.0 summary is a URL fragment; it should quote the "## Security" paragraph. Hit itself is right.
|