Rotimi Best
25d1a8d710
Critical security fixes addressing email verification bypass vulnerabilities: Security Issues Fixed: - Email verification status manipulation through client-side profile updates - Base64 token forgery allowing arbitrary email verification - DOM manipulation bypasses of email verification modal Backend Security Enhancements: - Secure verification tokens table with cryptographic token generation - RLS policies preventing direct email verification status changes - Server-side validation functions with expiration and ownership checks - Database triggers blocking unauthorized verification status updates - IP address logging and audit trails for security monitoring Frontend Security Protections: - Multi-layered DOM protection preventing UI manipulation bypasses - Continuous monitoring and re-application of interaction restrictions - CSS-based backup protection even if JavaScript is disabled - Mutation observer to protect dynamically added elements - Enhanced CSP configuration for Senja widget support API Security Updates: - Secure token-based verification replacing insecure Base64 method - Comprehensive error handling with security-focused user messages - Token validation with signature verification and expiration checks - Legacy verification method blocking with security warnings - Enhanced verification email generation with secure tokens Files Modified: - Database: New email_verification_tokens table and security functions - API: Secure verification endpoints with token validation - Frontend: DOM protection and verification modal enhancements - CSP: Updated Content Security Policy configuration - Blog: Security advisory for CVE-2025-65675 disclosure This release patches critical authentication bypass vulnerabilities and implements defense-in-depth security measures across the entire platform. Security researchers and users should upgrade immediately.
126 lines
4.0 KiB
JavaScript
126 lines
4.0 KiB
JavaScript
import 'dotenv/config';
|
|
|
|
import adapterNode from '@sveltejs/adapter-node';
|
|
import adapterVercel from '@sveltejs/adapter-vercel';
|
|
import path from 'path';
|
|
import { vitePreprocess } from '@sveltejs/kit/vite';
|
|
|
|
const useNodeAdapter = process.env.PUBLIC_IS_SELFHOSTED === 'true';
|
|
|
|
/** @type {import('@sveltejs/kit').Config} */
|
|
const config = {
|
|
// Consult https://kit.svelte.dev/docs/integrations#preprocessors
|
|
// for more information about preprocessors
|
|
preprocess: [vitePreprocess({})],
|
|
|
|
kit: {
|
|
adapter: useNodeAdapter ? adapterNode() : adapterVercel(),
|
|
alias: {
|
|
$lib: path.resolve('./src/lib'),
|
|
$mail: path.resolve('./src/mail')
|
|
},
|
|
csp: {
|
|
directives: {
|
|
'default-src': ['self'],
|
|
'script-src': [
|
|
'self',
|
|
'https://assets.cdn.clsrio.com',
|
|
'https://cdnjs.cloudflare.com',
|
|
'https://*.i.posthog.com',
|
|
'https://*.senja.io'
|
|
],
|
|
'style-src': [
|
|
'self',
|
|
'unsafe-inline',
|
|
'https://cdn.plyr.io',
|
|
'https://unpkg.com/[email protected]/dist/katex.min.css',
|
|
'https://assets.cdn.clsrio.com/eqneditor_1.css'
|
|
],
|
|
'style-src-elem': [
|
|
'self',
|
|
'unsafe-inline',
|
|
'https://cdn.plyr.io',
|
|
'https://unpkg.com/[email protected]/dist/katex.min.css',
|
|
'https://assets.cdn.clsrio.com/eqneditor_1.css'
|
|
],
|
|
'font-src': ['self', 'https://fonts.gstatic.com', 'https://cdn.plyr.io'],
|
|
'img-src': ['self', 'data:', 'https:'],
|
|
'media-src': ['self', 'https:', 'data:'],
|
|
'frame-src': ['self', 'https://www.youtube.com', 'https://youtube.com'],
|
|
'connect-src': [
|
|
'self',
|
|
'https://*.supabase.co',
|
|
'https://pgrest.classroomio.com',
|
|
'https://api.classroomio.com',
|
|
'https://assets.cdn.clsrio.com',
|
|
'https://cdn.plyr.io',
|
|
'https://*.i.posthog.com',
|
|
'https://umami.hz.oncws.com',
|
|
'https://*.r2.cloudflarestorage.com',
|
|
'http://localhost:54321',
|
|
'ws://localhost:54321',
|
|
'wss://*.classroomio.com',
|
|
'wss://*.supabase.co',
|
|
'https://*.senja.io'
|
|
],
|
|
'object-src': ['none'],
|
|
'base-uri': ['self'],
|
|
'form-action': ['self'],
|
|
'frame-ancestors': ['none'],
|
|
'upgrade-insecure-requests': true
|
|
},
|
|
reportOnly: {
|
|
'default-src': ['self'],
|
|
'script-src': [
|
|
'self',
|
|
'https://assets.cdn.clsrio.com',
|
|
'https://cdnjs.cloudflare.com',
|
|
'https://*.i.posthog.com',
|
|
'https://*.senja.io'
|
|
],
|
|
'style-src': [
|
|
'self',
|
|
'unsafe-inline',
|
|
'https://cdn.plyr.io',
|
|
'https://unpkg.com/[email protected]/dist/katex.min.css',
|
|
'https://assets.cdn.clsrio.com/eqneditor_1.css'
|
|
],
|
|
'style-src-elem': [
|
|
'self',
|
|
'unsafe-inline',
|
|
'https://cdn.plyr.io',
|
|
'https://unpkg.com/[email protected]/dist/katex.min.css',
|
|
'https://assets.cdn.clsrio.com/eqneditor_1.css'
|
|
],
|
|
'font-src': ['self', 'https://fonts.gstatic.com', 'https://cdn.plyr.io'],
|
|
'img-src': ['self', 'data:', 'https:'],
|
|
'media-src': ['self', 'https:', 'data:'],
|
|
'frame-src': ['self', 'https://www.youtube.com', 'https://youtube.com'],
|
|
'connect-src': [
|
|
'self',
|
|
'https://*.supabase.co',
|
|
'https://pgrest.classroomio.com',
|
|
'https://api.classroomio.com',
|
|
'https://assets.cdn.clsrio.com',
|
|
'https://cdn.plyr.io',
|
|
'https://*.i.posthog.com',
|
|
'https://umami.hz.oncws.com',
|
|
'https://*.r2.cloudflarestorage.com',
|
|
'http://localhost:54321',
|
|
'ws://localhost:54321',
|
|
'wss://*.supabase.co',
|
|
'wss://*.classroomio.com',
|
|
'https://*.senja.io'
|
|
],
|
|
'object-src': ['none'],
|
|
'base-uri': ['self'],
|
|
'form-action': ['self'],
|
|
'frame-ancestors': ['none'],
|
|
'report-uri': ['/csp-report']
|
|
}
|
|
}
|
|
}
|
|
};
|
|
|
|
export default config;
|