CalvinBackup/donutbrowser
1
0
Fork 0
mirror of https://github.com/zhom/donutbrowser.git synced 2026-09-23 09:50:58 +02:00
Code Issues Packages Projects Releases Wiki Activity

refactor: backend-authoritative team scope and config/input hardening

Browse Source
This commit is contained in:
zhom
2026-07-08 01:19:52 +04:00
parent 8162ad5a82
commit 78803ab289
6 changed files with 196 additions and 110 deletions
Download Patch File Download Diff File Expand all files Collapse all files
donut-sync/src/main.ts
+17 -1
View File
@@ -2,11 +2,27 @@ import { NestFactory } from "@nestjs/core";
import type { NestExpressApplication } from "@nestjs/platform-express";
import { AppModule } from "./app.module.js";
const INSECURE_DEFAULT_TOKENS = new Set([
"secret-sync-token",
"CHANGE_ME_generate_a_long_random_secret",
"CHANGE_ME",
]);
function validateEnv() {
if (!process.env.SYNC_TOKEN && !process.env.SYNC_JWT_PUBLIC_KEY) {
const token = process.env.SYNC_TOKEN;
if (!token && !process.env.SYNC_JWT_PUBLIC_KEY) {
console.error("Either SYNC_TOKEN or SYNC_JWT_PUBLIC_KEY must be set");
process.exit(1);
}
// A static SYNC_TOKEN is the only credential on a self-hosted server that is
// typically exposed on 0.0.0.0, so reject the shipped placeholders and any
// token short enough to brute-force.
if (token && (INSECURE_DEFAULT_TOKENS.has(token) || token.length < 24)) {
console.error(
"SYNC_TOKEN is a known default or too short. Set a long, random secret, e.g. `openssl rand -hex 32`.",
);
process.exit(1);
}
}
async function bootstrap() {