fix: prevent client-controlled field injection via object spread#9037
Open
Yzgaming005 wants to merge 4 commits into
Open
fix: prevent client-controlled field injection via object spread#9037Yzgaming005 wants to merge 4 commits into
Yzgaming005 wants to merge 4 commits into
Conversation
added 4 commits
June 27, 2026 12:43
- Updated errorHandler to recognize body-parser parse errors (entity.parse.failed)
and return HTTP 400 with { success: false, message } shape
- Added ZodError recognition in errorHandler returning 400 with structured issues
- Added catchAsync utility to forward async errors to Express error handler
- Wrapped auth and job route handlers with catchAsync
- Added regression tests for malformed JSON, invalid registration, and missing fields
Closes SecureBananaLabs#9020
Closes SecureBananaLabs#9018
Ref: SecureBananaLabs#743
- Added 5 MB file size limit to Multer configuration - Updated errorHandler to recognize LIMIT_FILE_SIZE errors and return HTTP 413 - Wrapped upload route with catchAsync for proper error forwarding - Added regression tests for small (accepted) and oversized (rejected) uploads Closes SecureBananaLabs#9028 Ref: SecureBananaLabs#743
- Protected /api/auth/refresh route with authMiddleware - Updated refreshToken service to accept subject and role parameters - Updated refresh controller to pass authenticated user's sub and role - Added regression tests for unauthenticated rejection and identity preservation Closes SecureBananaLabs#9030 Ref: SecureBananaLabs#743
- Moved spread operator before server-controlled fields in messageService.js - Moved spread operator before server-controlled fields in jobService.js - Clients can no longer override id, status, or sentAt via request payload - Added regression tests for both message and job creation Closes SecureBananaLabs#9036 Ref: SecureBananaLabs#743
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
/claim #9036
Summary
...payload) to the beginning of object literals inmessageService.jsandjobService.jsid,status,sentAt) now come AFTER the spread, preventing client overrideid,status, andsentAtvalues are ignoredTest Results
Validation
Ref: #743