Enhance Security and Prevent Unauthorized Access: Refuse 'password' as Custom shortURL, Protect Deletion of Key, and Skip 'password' in localStorage

[nazdridoy]

Pull Request Description

Refuse 'password" as Custom shortURL

• Introduces a check to prevent the use of "password" as a custom shortURL, enhancing security.

Do not accecpt any del cmd for "password" !IMPORTANT!

• Implements a critical security fix to disallow unauthorized deletion of the "password" key. Previously, a malicious actor could potentially forge a POST request, leading to a 500 Internal Server Error with the appropriate error message.

Skip adding the entry if the key is "password" (ref commit: 05353cf)

• Enhances the security of the website by preventing the unintentional exposure of sensitive information stored in the browser's localStorage. Previously, the application would load and list all entries from the localStorage, including entries with keys like "password." This posed a security risk, allowing users to manually add a "password" key to the localStorage, and subsequently, deleting it would disrupt the site's functionality. The updated logic skips adding any entry with the key "password," mitigating the risk of accidental or intentional deletion of this sensitive information.

Changes

• Mainly includes security enhancements and crucial fixes to prevent unauthorized access and maintain the stability of the website.

Additional Information

• Showing with 29 additions and 10 deletions across main.js and worker.js.
• Commits authored by @nazdridoy.

""""""""""

[crazypeace]

Hi,
Thanks for your PR.
Somehow I didn't get any notification from Github about this, so I missed, sorry.
Recently, I made a function of load KV. Then there is possiblity to display delete button for 'password'. So I set a protect_keylist to prevent delete 'password'.

const protect_keylist = [
  "password",
]

About the display 'password', I think:

1. The backend of this project is more like a general KV database, so I just let 'password' displayed as other records.
2. The one who can see the 'password' already know it.
3. I set a protection for deleting it.

So I think it's enough, thus I don't set a filter to hide it from the operation UI.
Whatever, that's only my personal idea. I'm not very sure that I'm correct. I may change my mind in the future. But just now I made this decision and set it this way.

[crazypeace]

Now I set this:
At the backend, protect the protect_keylist from add, del, qry cmd.
And hide this in qryall cmd.
af380db

[nazdridoy]

Now I set this: At the backend, protect the protect_keylist from add, del, qry cmd. And hide this in qryall cmd. af380db

well done @crazypeace .So far, these issuses seem resolved. I'm closing this PR.