Jeremy Knows
3eceedb9c6
The username query param was interpolated directly into the GitHub GraphQL
query string (user(login: "${username}")) sent with the server token, and
the route only validated it as a string, so a value containing a quote could
break out of the string literal and alter the query document. Impact depends
on the token's scope; at minimum it allows tampering with the query structure.
Two changes:
- Pass the username as a $login GraphQL variable so it can never alter the
query document (the actual fix).
- Validate username against GitHub's username format at the route as
defense-in-depth, rejecting malformed input before it reaches the API.
Adds a regression test for the query builder (bun test). No change in
returned data for valid usernames.
DeFlock
Crowdsourced tool for locating and reporting ALPRs. View Live Site.
Purpose
I created this project after noticing the mass deployment of ALPRs in cities, towns, and even rural areas in the recent years. It's a massive threat to privacy, and this projects helps shed a light on this issue as ALPRs continue to be deployed to thousands of cities across the US and possibly beyond.
What it Does
View ALPRs on a Map
Uses OpenStreetMap data to populate a map with crowdsourced locations of ALPRs, along with their type and direction they face.
The map has become a separate repository, deflockhopper_maps.
Report ALPRs
Provides instructions for using the DeFlock App or OpenStreetMap's iD web editor to report ALPRs using a standardized tagging system.
Identify ALPRs
A constantly-growing repository of ALPR makes, models, and tagging instructions for OpenStreetMap, along with images for identifying them.
Tech Stack
Backend
- TypeScript
- Fastify API server
- Cloudflare R2 for ALPR points and vector tiles
- OpenTelemetry
Cloud
- AWS Lambda (for region segmenting [deprecated] and counts)
- AWS S3 - phasing out for R2
- AWS ECR
- Cloudflare as DNS + Proxy
- Directus CDN
- Zammad helpdesk
Frontend
- Vue3
- Vuetify
- MapLibre GL
- Vue Leaflet [deprecated] - phasing out for MapLibre GL
Services
- OpenStreetMap - Overpass API, Basic Map Tiles [deprecated]
- Nominatim - Geocoding
Development
Requirements
Running Frontend
cd webappbun ibun dev
Running Backend
cd apibun ibun dev
Contributing
We welcome contributions from anyone. Here's how you can help:
How to Contribute
- Fork the Repository
- Make Your Changes
- Open a Pull Request against This Repo