mirror of
https://github.com/Sea-Haven-Industries/proposal-system.git
synced 2026-10-01 14:03:13 +00:00
9e579f84e2
* fix: bump nanoid to 3.3.16 and postcss to 8.5.26 Bump nanoid from 3.3.16 to 3.3.18 in web/ Bump postcss from 8.5.25 to 8.5.26 in web/ Closes [Dependabot 47] (https://github.com/Sea-Haven-Industries/proposal-system/security/dependabot/47) * fix(api): sanitize request path in internal API key logs (SEC-29) Strip CR/LF from Request.Path before logging invalid-key and disallowed-path warnings so CodeQL alerts 4 and 5 close without changing 401/403 behavior. * fix(api): log user id instead of email on cognito role sync (SEC-29) Keep AuthResponse.Email unchanged so CodeQL alert 1 closes without altering the callback payload. * fix(api): use sanitized path on both internal key logs (SEC-29) The 401 branch referenced an out-of-scope identifier and the 403 branch skipped SanitizeForLog. Cover newline-in-path logs and Cognito role-sync user-id logging with tests. |
||
|---|---|---|
| .. | ||
| AdminController.cs | ||
| AuthController.cs | ||
| CustomersController.cs | ||
| FilesController.cs | ||
| GeneratedPdfsController.cs | ||
| LineItemsController.cs | ||
| PricingLibraryController.cs | ||
| ProposalsController.cs | ||
| SitesController.cs | ||
| UsersController.cs | ||
| VendorProposalsController.cs | ||