Daniel Volz
cb1810586d
- Add URL validation to prevent SSRF attacks on notification endpoints - Block private IPs (10.x, 172.16-31.x, 192.168.x, 169.254.x) - Block localhost and internal hostnames - Only allow HTTP/HTTPS protocols - Add HTML escaping for medication names in email templates (XSS) - Add stricter rate limiting for auth routes (5 req/15min for login/register) - Add SSRF protection tests (405 tests total)
44 lines
1.1 KiB
JSON
44 lines
1.1 KiB
JSON
{
|
|
"name": "medassist-ng-backend",
|
|
"version": "1.0.2",
|
|
"private": true,
|
|
"type": "module",
|
|
"scripts": {
|
|
"dev": "tsx watch src/index.ts",
|
|
"build": "tsc -p tsconfig.json",
|
|
"start": "node dist/index.js",
|
|
"migrate": "tsx src/db/migrate.ts",
|
|
"test": "vitest",
|
|
"test:run": "vitest run",
|
|
"test:coverage": "vitest run --coverage"
|
|
},
|
|
"dependencies": {
|
|
"@fastify/cookie": "^10.0.1",
|
|
"@fastify/cors": "^10.0.1",
|
|
"@fastify/helmet": "^13.0.2",
|
|
"@fastify/jwt": "^10.0.0",
|
|
"@fastify/multipart": "^9.3.0",
|
|
"@fastify/rate-limit": "^10.3.0",
|
|
"@fastify/sensible": "^6.0.4",
|
|
"@fastify/static": "^8.3.0",
|
|
"@libsql/client": "^0.10.0",
|
|
"argon2": "^0.40.0",
|
|
"dotenv": "^16.4.5",
|
|
"drizzle-orm": "^0.32.2",
|
|
"fastify": "^5.0.0",
|
|
"nodemailer": "^7.0.11",
|
|
"openid-client": "^6.8.1",
|
|
"zod": "^3.23.8"
|
|
},
|
|
"devDependencies": {
|
|
"@types/node": "^22.7.4",
|
|
"@types/nodemailer": "^6.4.21",
|
|
"@types/supertest": "^6.0.2",
|
|
"@vitest/coverage-v8": "^2.1.9",
|
|
"supertest": "^7.0.0",
|
|
"tsx": "^4.19.0",
|
|
"typescript": "^5.5.4",
|
|
"vitest": "^2.1.8"
|
|
}
|
|
}
|