Save permissions

[kixelated]

No description provided.

[claude]

Claude finished @kixelated's task —— View job

---

Security Review ✅

I've reviewed the PR for bugs and security vulnerabilities. Here are my findings:

Todo List

• Read CLAUDE.md for repository context
• Review security-sensitive API files (auth.ts, room.ts, account.ts)
• Review new local.ts file for potential issues
• Review frontend changes for security implications
• Post concise review findings to GitHub comment

Security Issues Found

🟡 Medium: Guest ID Validation Bypass - api/src/room.ts:72-74

const guest = c.req.valid("json").guest;
if (guest?.id.startsWith("guest/")) {
    info = guest;
}

The validation only checks if the ID starts with "guest/" but doesn't validate the full ID format or prevent malicious values in other fields (name, avatar). An attacker could provide arbitrary name or avatar values that might cause issues downstream.

🟡 Medium: Stored XSS via Settings - app/src/settings.tsx:30-40

Settings.guest.set(Api.Account.infoSchema.safeParse(JSON.parse(guestRaw)).data);

Guest account data from localStorage is stored without sanitization and used in UI rendering. If an attacker can control localStorage (e.g., via XSS), they could inject malicious content into the guest name/avatar that gets rendered without escaping.

Clean Areas

• JWT implementation in auth.ts uses proper validation with jose library
• File upload validation in account.ts includes size limits and content type checks
• Media stream access controls appear properly implemented
• No hardcoded secrets or credentials found

Recommendations

1. Add validation for guest name/avatar fields beyond just ID prefix checking
2. Sanitize guest data from localStorage before storing in signals
3. Ensure all user-provided content is properly escaped when rendered in UI

---