fix(security): input validation, remove JWT secret fallbacks, restrict WS CORS, add WS auth guard (#505, #794, #795, #796) #698
RUKAYAT-CODERAnnotations
10 errors and 2 warnings
|
validate:
src/collaboration/collaboration.module.ts#L45
Replace `·/*·handled·by·origin·callback·below·*/` with `⏎······/*·handled·by·origin·callback·below·*/⏎···`
|
|
|
|
|
|
validate:
src/auth/guards/ws-auth.guard.spec.ts#L54
Replace `{·sub:·'user-1'·},·{·secret:·'wrong-secret-xxxxxxxxxxxxxxxxxxxxxxxxx'·}` with `⏎······{·sub:·'user-1'·},⏎······{·secret:·'wrong-secret-xxxxxxxxxxxxxxxxxxxxxxxxx'·},⏎····`
|
|
validate:
src/auth/guards/ws-auth.guard.spec.ts#L44
Replace `⏎······{·sub:·'user-1'·},⏎······{·secret:·VALID_SECRET,·expiresIn:·'-1s'·},⏎····` with `{·sub:·'user-1'·},·{·secret:·VALID_SECRET,·expiresIn:·'-1s'·}`
|
|
validate:
src/auth/guards/ws-auth.guard.spec.ts#L27
Replace `·getOrThrow:·jest.fn().mockReturnValue(VALID_SECRET)` with `⏎······getOrThrow:·jest.fn().mockReturnValue(VALID_SECRET),⏎···`
|
|
validate:
src/auth/dto/auth.dto.ts#L74
Insert `⏎`
|
|
validate:
src/auth/dto/auth.dto.ts#L67
Insert `⏎·····`
|
|
validate:
src/auth/dto/auth.dto.ts#L19
Insert `⏎·····`
|
|
validate:
src/auth/dto/auth.dto.ts#L1
Replace `⏎··IsEmail,⏎··IsString,⏎··MinLength,⏎··MaxLength,⏎··Matches,⏎··IsOptional,⏎` with `·IsEmail,·IsString,·MinLength,·MaxLength,·Matches,·IsOptional·`
|
|
validate
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-node@v4, pnpm/action-setup@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
validate:
src/auth/dto/auth.dto.ts#L7
'IsOptional' is defined but never used. Allowed unused vars must match /^_/u
|