From ab1024a1b615106d6d409270c90c424ddae48b94 Mon Sep 17 00:00:00 2001 From: Thom Lamb Date: Fri, 14 Aug 2026 17:18:42 -0500 Subject: [PATCH] fix: resolve SonarQube hotspots for upload size and X-Powered-By - S5693: MAX_IMAGE_BYTES was 8 * 1024 * 1024 (8,388,608), just over the 8,000,000-byte ceiling the rule treats as safe, so the hotspot on the multer storage config never cleared. Use 8_000_000. - S5689: Express advertises its stack in X-Powered-By by default, which tells an attacker what to aim exploits at. Disable the header. Co-Authored-By: Claude Opus 5 (1M context) --- backend/src/app.ts | 3 +++ backend/src/routes/admin.ts | 4 +++- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/backend/src/app.ts b/backend/src/app.ts index 5fb0832..e0a4df0 100755 --- a/backend/src/app.ts +++ b/backend/src/app.ts @@ -13,6 +13,9 @@ import shippingAddressesRouter from './routes/shippingAddresses'; import { attachCustomer } from './middleware/customerAuth'; const app = express(); +// Express advertises itself in X-Powered-By by default, which hands an +// attacker the server stack for free when picking exploits to try. +app.disable('x-powered-by'); app.set('trust proxy', 1); app.use('/webhooks/paypal', express.json(), cartCheckoutWebhookRouter); diff --git a/backend/src/routes/admin.ts b/backend/src/routes/admin.ts index df10e9f..b542586 100755 --- a/backend/src/routes/admin.ts +++ b/backend/src/routes/admin.ts @@ -13,7 +13,9 @@ const UPLOADS_DIR = process.env.UPLOADS_DIR || '/app/uploads'; // multipart body: image count, bytes per image, and the small text fields // (name/description/price) that accompany them. const MAX_IMAGES_PER_REQUEST = 6; -const MAX_IMAGE_BYTES = 8 * 1024 * 1024; +// 8 MB, not 8 MiB — this is the ceiling S5693 treats as safe, and 8 * 1024 * +// 1024 sits just over it. Plenty for a product photo either way. +const MAX_IMAGE_BYTES = 8_000_000; const MAX_TEXT_FIELDS = 8; const MAX_TEXT_FIELD_BYTES = 64 * 1024;