fix: resolve SonarQube hotspots for upload size and X-Powered-By #16

2026-08-14T17:21:01-05:00

bermudalamb commented

2026-08-14 17:21:01 -05:00

Clears two SonarQube security hotspots.

typescript:S5693 — backend/src/routes/admin.ts

MAX_IMAGE_BYTES was 8 * 1024 * 1024 = 8,388,608, which is 388,608 bytes over the 8,000,000-byte ceiling the rule treats as safe — so the hotspot on the multer storage config survived the earlier limits fix. Now 8_000_000, with a comment on the MB-vs-MiB distinction so it doesn't get "tidied" back to a power of two.

typescript:S5689 — backend/src/app.ts

Express advertises its stack in X-Powered-By by default, which tells an attacker what to aim exploits at. Added app.disable('x-powered-by'). The rule also accepts helmet.hidePoweredBy(), but helmet isn't a dependency and adding one for a single header isn't worth it. Nothing in the repo reads or asserts that header.

Verification

npx tsc --noEmit — clean
Unit tests — 16/16
Integration tests — 14/14

🤖 Generated with Claude Code

Clears two SonarQube security hotspots. **`typescript:S5693` — `backend/src/routes/admin.ts`** `MAX_IMAGE_BYTES` was `8 * 1024 * 1024` = 8,388,608, which is 388,608 bytes over the 8,000,000-byte ceiling the rule treats as safe — so the hotspot on the multer storage config survived the earlier limits fix. Now `8_000_000`, with a comment on the MB-vs-MiB distinction so it doesn't get "tidied" back to a power of two. **`typescript:S5689` — `backend/src/app.ts`** Express advertises its stack in `X-Powered-By` by default, which tells an attacker what to aim exploits at. Added `app.disable('x-powered-by')`. The rule also accepts `helmet.hidePoweredBy()`, but helmet isn't a dependency and adding one for a single header isn't worth it. Nothing in the repo reads or asserts that header. ## Verification - `npx tsc --noEmit` — clean - Unit tests — 16/16 - Integration tests — 14/14 🤖 Generated with [Claude Code](https://claude.com/claude-code)

bermudalamb added 1 commit 2026-08-14 17:21:03 -05:00

fix: resolve SonarQube hotspots for upload size and X-Powered-By

SonarQube Analysis / sonarqube (pull_request) Successful in 7m11s

Details

Tests / backend-unit (pull_request) Successful in 2m18s

Details

Tests / backend-integration (pull_request) Successful in 2m28s

Details

Tests / frontend-e2e (pull_request) Failing after 59s

Details

ab1024a1b6

- S5693: MAX_IMAGE_BYTES was 8 * 1024 * 1024 (8,388,608), just over the
  8,000,000-byte ceiling the rule treats as safe, so the hotspot on the
  multer storage config never cleared. Use 8_000_000.
- S5689: Express advertises its stack in X-Powered-By by default, which
  tells an attacker what to aim exploits at. Disable the header.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

bermudalamb merged commit ecaef5dc6d into main

2026-08-14 17:24:07 -05:00

bermudalamb deleted branch fix/sonarqube-hotspots

2026-08-14 17:24:13 -05:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: bermudalamb/redefined-designs#16