Fix multiple reported Security Issues #580

New Issue

MrUnknownDE · 2026-04-05T17:22:46+02:00

MrUnknownDE commented

2026-04-05 17:22:46 +02:00

Originally created by @marcschaeferger on 11/30/2025

Community Contribution License Agreement

By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.

Description (generated by Copilot)

See

Code generated by Copilot

This pull request focuses on improving randomness, validation, and security in the codebase. The main changes include switching to cryptographically secure random number generation for name creation, refining URL validation logic, and ensuring safe encoding of user input in password reset links.

Randomness and security improvements:

Switched from Math.random() to crypto.randomInt() in generateName() within server/db/names.ts, making name generation cryptographically secure. [1] [2]

Validation logic:

Updated the domain name regex in isUrlValid() in server/lib/validators.ts to more accurately validate domain names, preventing invalid formats.

User input handling:

Applied encodeURIComponent() to the email parameter in the password reset link in LoginForm.tsx, preventing potential issues with special characters and improving security.

How to test?

*Originally created by @marcschaeferger on 11/30/2025* ## Community Contribution License Agreement By creating this pull request, I grant the project maintainers an unlimited, perpetual license to use, modify, and redistribute these contributions under any terms they choose, including both the AGPLv3 and the Fossorial Commercial license terms. I represent that I have the right to grant this license for all contributed content. ## Description (generated by Copilot) See - https://codeql.github.com/codeql-query-help/javascript/js-insecure-randomness/ - https://codeql.github.com/codeql-query-help/javascript/js-redos/ - https://codeql.github.com/codeql-query-help/javascript/js-xss-through-dom/ **Code generated by Copilot** This pull request focuses on improving randomness, validation, and security in the codebase. The main changes include switching to cryptographically secure random number generation for name creation, refining URL validation logic, and ensuring safe encoding of user input in password reset links. **Randomness and security improvements:** * Switched from `Math.random()` to `crypto.randomInt()` in `generateName()` within `server/db/names.ts`, making name generation cryptographically secure. [[1]](diffhunk://#diff-7cd61a1ce3acb87dc3015b30bf9be7460e404e88671d64f2232d9a85ea9689fbR4) [[2]](diffhunk://#diff-7cd61a1ce3acb87dc3015b30bf9be7460e404e88671d64f2232d9a85ea9689fbL102-R106) **Validation logic:** * Updated the domain name regex in `isUrlValid()` in `server/lib/validators.ts` to more accurately validate domain names, preventing invalid formats. **User input handling:** * Applied `encodeURIComponent()` to the email parameter in the password reset link in `LoginForm.tsx`, preventing potential issues with special characters and improving security. ## How to test?

MrUnknownDE closed this issue

2026-04-05 17:22:46 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#580