Files

T

Paul Nothaft a7d0972b13 fix(security): make the CSS sanitizer's remote-URL block actually block

sanitizeCSS "blocked" a remote url() by prefixing it with a
/* BLOCKED URL */ COMMENT and leaving the URL in place. CSS comments are
discarded during tokenization, so the declaration a browser parsed still
carried the live URL — while adminCssTemplates returned
sanitization_warnings claiming it had been stopped. Protection that
reports success is worse than none, which is why it survived review.

Scope is narrow: sanitizeCss (lowercase, the public-site path) never
included the pattern and permits remote URLs by design — a test now pins
that. Only sanitizeCSS (uppercase) was affected; outside this repo's
newsletter branch its sole caller is adminCssTemplates.js.

Migration 200 is required, not cosmetic: gallery.js serves
css_templates.css_content VERBATIM as text/css and does not re-sanitize on
read, so fixing the write path alone would leave every existing template
serving its URL forever.

Review follow-ups replaced the regex with a small three-state lexer
(comment / string / identifier) over the RAW text, after five further
bypasses: a ")" inside a quoted url(), CSS escapes (u\72l), the HTML
comment strip JOINING tokens into a live url() after the scan, an escaped
quote desynchronising the scan, and a quote inside a comment. Escapes are
decoded only to decide, never to rewrite — a clean input now round-trips
byte-identical, which also keeps unaffected rows out of the migration's
write path.

Severity is low (writing a template needs branding.edit) but the harm is
a gallery visitor's IP reaching a third party from a page the operator
believes carries no remote requests.

2026-09-04 14:27:08 +02:00

core

fix(security): make the CSS sanitizer's remote-URL block actually block

2026-09-04 14:27:08 +02:00

legacy

fix: prevent database migration restart failures

2026-01-15 15:43:13 +01:00

041_add_logo_customization_settings.js

feat: implement gallery logo customization (Issue #17 )

2025-09-05 14:56:09 +02:00

helpers.js

Initial commit - Project start (July 17, 2025)

2025-07-24 16:57:07 +02:00

README.md

feat: pre-generate watermarks for instant lightbox loading

2026-01-15 21:00:10 +01:00

run-migrations-safe.js

fix(docker): default NODE_ENV=production so non-compose deploys don't fall back to SQLite (#1038 ) (#1039 )

2026-08-13 18:50:56 +02:00

run-migrations.js

fix(docker): default NODE_ENV=production so non-compose deploys don't fall back to SQLite (#1038 ) (#1039 )

2026-08-13 18:50:56 +02:00

README.md

Database Migrations

This directory contains database migrations for the PicPeak photo sharing platform.

Directory Structure

`/core`

Essential migrations that are always run for new deployments. These include:

init.js - Initial database schema creation
Backup service tables (029-035)
Gallery feedback tables (033)
Pre-generated watermarks (061)

`/legacy`

Migrations needed only when upgrading from older versions. New deployments can skip these as the core schema already includes all necessary tables and columns.

For New Deployments

If you're deploying this application for the first time:

The initializeDatabase() function in src/database/db.js will create all necessary tables
Only migrations in the /core directory will be run
This ensures a clean, optimized database schema

For Existing Deployments

If you're upgrading from an older version:

All migrations (both core and legacy) will be run in sequence
The migration system tracks which migrations have been applied
Only new migrations will be executed

Running Migrations

# Development
npm run migrate

# Production
npm run migrate:prod

Note on Duplicate Migration Numbers

The legacy directory contains renamed duplicates:

014_add_host_name_to_events_duplicate.js (was duplicate of 014)
027_add_rate_limit_settings_duplicate.js (was duplicate of 027)

These have been renamed to avoid conflicts while preserving the migration history.