fix: security hardening - XSS, CORS, and cache headers #1

Merged

jperera merged 1 commit from fix/security-hardening into main

2026-04-02 20:02:19 +02:00

jperera commented

2026-04-02 19:53:31 +02:00

Owner

Summary

XSS fix: Escape JSON data injected into <script> tags to prevent XSS via </script> breakout in station names (render.ts)
CORS headers: Add Access-Control-Allow-Origin: * to all JSON API responses (server.ts)
Cache headers: Add Cache-Control headers to static files (CSS: 1h, favicon: 24h) (server.ts)

Details

Station names from the API are embedded directly into JavaScript via JSON.stringify(). A station name containing </script> could break out of the script tag. Added safeJsonForScript() that escapes closing script tags in JSON output.

Test plan

Verify dashboard loads correctly with chart data
Verify API responses include CORS headers
Verify static files include Cache-Control headers
Run bun test to ensure existing tests pass

## Summary - **XSS fix**: Escape JSON data injected into `<script>` tags to prevent XSS via `</script>` breakout in station names (`render.ts`) - **CORS headers**: Add `Access-Control-Allow-Origin: *` to all JSON API responses (`server.ts`) - **Cache headers**: Add `Cache-Control` headers to static files (CSS: 1h, favicon: 24h) (`server.ts`) ## Details Station names from the API are embedded directly into JavaScript via `JSON.stringify()`. A station name containing `</script>` could break out of the script tag. Added `safeJsonForScript()` that escapes closing script tags in JSON output. ## Test plan - [ ] Verify dashboard loads correctly with chart data - [ ] Verify API responses include CORS headers - [ ] Verify static files include Cache-Control headers - [ ] Run `bun test` to ensure existing tests pass

jperera added 1 commit

2026-04-02 19:53:31 +02:00

fix: security hardening - XSS, CORS, and cache headers f21c44b060

- Escape JSON data injected into <script> tags to prevent XSS via
  </script> breakout in station names
- Add Access-Control-Allow-Origin header to all JSON API responses
- Add Cache-Control headers to static files (CSS: 1h, favicon: 24h)