Solarch Files

v0.11.0 — Security Remediation

Full security sweep of 32 findings across the tspoonbase codebase.

Critical (5)

• C-1 SQLi via index definitions — identifier validation + field-list-only mode
• C-2 SQLi via field names — column whitelist on INSERT/UPDATE
• C-3 Agent endpoints — auth middleware applied, secrets scrubbed from responses
• C-4 Weak encryption key — fallback removed, startup validation enforced
• C-5 WebSocket realtime — JWT auth + collection viewRule enforcement

High (11)

• H-1 CORS — explicit allowlist via CORS_ALLOWED_ORIGINS env
• H-2 SQLi in expression.field — field whitelist
• H-3 SQLi via sort param — strict identifier validation
• H-4 Path traversal — path.resolve prefix assertion on all file ops
• H-5 MIME spoofing — magic bytes detection replaces user-supplied mimetype
• H-6 Mass assignment — explicit field pick on collection updates
• H-7 Rate limiting — applied to admin auth + password reset
• H-8 Zip slip — per-entry path traversal check in backup restore
• H-9 OTP plaintext — SHA-256 hashed before storage
• H-10 Batch createRule bypass — rule enforcement per record
• H-11 Code injection — vm.Script sandbox replaces new Function()

Medium (9) + Low (7)

All addressed — see commit for full details.

New

• src/utils/sql_safe.ts — shared SQL identifier validation utility