Severity: Medium (security/abuse)
Three public endpoints have no auth, no rate limiting, and no size cap:
POST /api/paperwork-generators/save (save/route.ts) — writes an unbounded number of unique .json files to data/forms (each id is timestamped, so no overwrite) → disk exhaustion. Payloads are stored verbatim and later rendered by the generator UI (stored-content vector). (Filename itself is safe — sanitized.)POST /api/feedback and POST /api/error — forward arbitrary user content to a Discord webhook. Flooding spams the team channel and can trip Discords webhook rate limit (429), disabling legitimate reports. User text is injected into embed markdown fields (e.g. the [Send to GitHub](url) field).
Fix: Gate the save endpoint behind auth/the form-builder flag; add IP-based rate limiting and body-size caps to all three; sanitize user content placed in embeds.
Filed from a code audit of the current master. Line numbers are approximate.
Severity: Medium (security/abuse)
Three public endpoints have no auth, no rate limiting, and no size cap:
POST /api/paperwork-generators/save(save/route.ts) — writes an unbounded number of unique.jsonfiles todata/forms(eachidis timestamped, so no overwrite) → disk exhaustion. Payloads are stored verbatim and later rendered by the generator UI (stored-content vector). (Filename itself is safe — sanitized.)POST /api/feedbackandPOST /api/error— forward arbitrary user content to a Discord webhook. Flooding spams the team channel and can trip Discords webhook rate limit (429), disabling legitimate reports. User text is injected into embed markdown fields (e.g. the[Send to GitHub](url)field).Fix: Gate the save endpoint behind auth/the form-builder flag; add IP-based rate limiting and body-size caps to all three; sanitize user content placed in embeds.
Filed from a code audit of the current
master. Line numbers are approximate.