flutter/apidash
1
0
Fork 0
mirror of https://github.com/foss42/apidash.git synced 2025-12-08 05:59:15 +08:00
Code Issues Packages Projects Releases Wiki Activity

Simplify security implementation using modern 2025 patterns - integrate security directly with zero abstraction

Browse Source 
Co-authored-by: animator <615622+animator@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot]
2025-12-04 19:59:29 +00:00
parent 8f5c387018
commit ba46cb9cfa
9 changed files with 278 additions and 600 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
lib/providers/js_runtime_notifier.dart
View File

@@ -44,34 +44,22 @@ class JsRuntimeNotifier extends StateNotifier<JsRuntimeState> {
late final JavascriptRuntime _runtime;
String? _currentRequestId;
// Security: Maximum script length to prevent DoS attacks
static const int _maxScriptLength = 50000; // 50KB
// Modern 2025 security: Simple pattern-based validation
static const _maxScriptSize = 50000; // 50KB limit
static final _dangerousPatterns = RegExp(
r'eval\s*\(|Function\s*\(|constructor\s*\[|__proto__',
caseSensitive: false,
);
// Security: Dangerous JavaScript patterns that could lead to code injection
static const List<String> _dangerousPatterns = [
r'eval\s*\(',
r'Function\s*\(',
r'constructor\s*\[',
r'__proto__',
];
/// Validates user script for basic security checks
/// Returns null if valid, error message if invalid
/// Validate script before execution (zero-trust approach)
String? _validateScript(String script) {
// Check script length to prevent DoS
if (script.length > _maxScriptLength) {
return 'Script exceeds maximum length of $_maxScriptLength characters';
if (script.length > _maxScriptSize) {
return 'Script too large (max 50KB)';
}
// Check for dangerous patterns
for (final pattern in _dangerousPatterns) {
final regex = RegExp(pattern, caseSensitive: false);
if (regex.hasMatch(script)) {
return 'Script contains potentially dangerous pattern: ${pattern.replaceAll(r'\s*\(', '(').replaceAll(r'\s*\[', '[')}';
}
if (_dangerousPatterns.hasMatch(script)) {
return 'Script contains unsafe patterns';
}
return null; // Script is valid
return null; // Valid
}
void _initialize() {