Security: 3 automated fixes (3 HIGH) - #5
Conversation
scan_id: f667dec6-ee1b-4c43-9470-c46e8239a6d9 files_changed: 3
There was a problem hiding this comment.
Each inline comment below explains what changed on that line and why. The high-level summary per file:
next.config.ts
Re-enabled build-time TypeScript type checking and ESLint linting by setting ignoreBuildErrors and ignoreDuringBuilds to false. This ensures type-confusion bugs and security-relevant lint findings block production builds instead of shipping silently.
src/app/api/inbox/messages/[chatId]/route.ts
Added an authentication check at the start of the GET handler so that message history can only be fetched by an authenticated operator session, preventing unauthenticated users from enumerating and reading arbitrary conversations by chatId (IDOR).
src/app/api/whatsapp/status/route.ts
The status endpoint returned the WhatsApp client state—including the linking QR code—to any unauthenticated caller. The fix requires a valid authenticated session before returning the state, preventing attackers from capturing the QR and hijacking the WhatsApp account.
| /* config options here */ | ||
| typescript: { | ||
| ignoreBuildErrors: true, | ||
| ignoreBuildErrors: false, |
There was a problem hiding this comment.
✏️ Setting ignoreBuildErrors to false restores TypeScript type checking during production builds, so type-confusion and unsafe data-shape errors are caught before deployment.
| }, | ||
| eslint: { | ||
| ignoreDuringBuilds: true, | ||
| ignoreDuringBuilds: false, |
There was a problem hiding this comment.
✏️ Setting ignoreDuringBuilds to false restores ESLint enforcement during builds, so security-relevant lint findings (e.g., dangerous patterns) block the build.
|
|
||
| import { NextResponse } from 'next/server'; | ||
| import { getMessages } from '@/lib/db'; | ||
| import { requireSession } from '@/lib/auth'; |
There was a problem hiding this comment.
➕ Imports the session-enforcement helper used to authenticate the request before any data is accessed.
| { params }: { params: { chatId: string } } | ||
| ) { | ||
| try { | ||
| await requireSession(request); |
There was a problem hiding this comment.
➕ Enforces an authenticated operator session before reading messages. If the session is missing/invalid, this throws and the request is rejected, blocking unauthenticated access to arbitrary chatId conversations.
| @@ -1,9 +1,15 @@ | |||
| import { NextResponse } from 'next/server'; | |||
| import { getClientState } from '@/lib/whatsapp-client'; | |||
| import { auth } from '@/lib/auth'; | |||
There was a problem hiding this comment.
➕ Imports the authentication helper used to verify the caller has a valid session before exposing sensitive state.
| export const dynamic = 'force-dynamic'; | ||
|
|
||
| export async function GET() { | ||
| export async function GET(req: Request) { |
There was a problem hiding this comment.
➕ New handler signature accepts the request so the session can be validated from request context.
|
|
||
| export async function GET() { | ||
| export async function GET(req: Request) { | ||
| const session = await auth(req); |
There was a problem hiding this comment.
➕ Resolves the current session to determine whether the caller is authenticated.
| export async function GET() { | ||
| export async function GET(req: Request) { | ||
| const session = await auth(req); | ||
| if (!session) { |
There was a problem hiding this comment.
➕ Rejects requests that lack a valid session, blocking anonymous access to the QR.
| export async function GET(req: Request) { | ||
| const session = await auth(req); | ||
| if (!session) { | ||
| return NextResponse.json({ error: 'Unauthorized' }, { status: 401 }); |
There was a problem hiding this comment.
➕ Returns a 401 instead of leaking the WhatsApp linking secret to unauthenticated callers.
|
|
||
| export const dynamic = 'force-dynamic'; | ||
|
|
||
| export async function GET() { |
There was a problem hiding this comment.
➖ Removed the unauthenticated handler that returned the QR/client state to anyone.
usualdork
changed the title
1 participant
Summary
This pull request was opened automatically based on findings from a security scan. Please review the diff carefully before merging — automated fixes are best-effort and may require adjustments.
Findings addressed
Per-finding detail
next.config.ts:4src/app/api/inbox/messages/[chatId]/route.ts:1src/app/api/whatsapp/status/route.ts:1Files changed
next.config.ts(1 finding)src/app/api/inbox/messages/[chatId]/route.ts(1 finding)src/app/api/whatsapp/status/route.ts(1 finding)What changed and why
next.config.tsRe-enabled build-time TypeScript type checking and ESLint linting by setting ignoreBuildErrors and ignoreDuringBuilds to false. This ensures type-confusion bugs and security-relevant lint findings block production builds instead of shipping silently.
src/app/api/inbox/messages/[chatId]/route.tsAdded an authentication check at the start of the GET handler so that message history can only be fetched by an authenticated operator session, preventing unauthenticated users from enumerating and reading arbitrary conversations by chatId (IDOR).
src/app/api/whatsapp/status/route.tsThe status endpoint returned the WhatsApp client state—including the linking QR code—to any unauthenticated caller. The fix requires a valid authenticated session before returning the state, preventing attackers from capturing the QR and hijacking the WhatsApp account.
Scan metadata
f667dec6-ee1b-4c43-9470-c46e8239a6d9claude-opus-4-7Do not auto-merge; every patch must be reviewed by a human.