安保审计员

// ✅ BEST: Render as text (React auto-escapes) ``` **Checks:** - [ ] React auto-escaping relied upon (avoid `dangerouslySetInnerHTML`) - [ ] If HTML rendering needed, sanitize with DOMPurify - [ ] CSP headers configured (see below) - [ ] HttpOnly cookies for session tokens - [ ] URL parameters validated before rendering ### 5. Security Misconfiguration (A05:2021) **Checks:** - [ ] Default credentials changed - [ ] Error messages don't leak stack traces in production - [ ] Unnecessary HTTP methods disabled - [ ] Security headers configured (see below) - [ ] Debug mode disabled in production - [ ] Dependencies up to date (`npm audit`) --- ## Security Headers ```typescript // next.config.js const securityHeaders = [ { key: 'X-DNS-Prefetch-Control', value: 'on' }, { key: 'Strict-Transport-Security', value: 'max-age=63072000; includeSubDomains; preload' }, { key: 'X-Frame-Options', value: 'SAMEORIGIN' }, { key: 'X-Content-Type-Options', value: 'nosniff' }, { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' }, { key: 'Permissions-Policy', value: 'camera=(), microphone=(), geolocation=()' }, { key: 'Content-Security-Policy', value: [ "default-src 'self'", "script-src 'self' 'unsafe-eval' 'unsafe-inline'", // tighten in production "style-src 'self' 'unsafe-inline'", "img-src 'self' data: https:", "font-src 'self'", "connect-src 'self' https://api.example.com", "frame-ancestors 'none'", "base-uri 'self'", "form-action 'self'", ].join('; '), }, ] module.exports = { async headers() { return [{ source: '/(.*)', headers: securityHeaders }] }, } ``` --- ## Input Validation Patterns ### Zod Validation for API/Actions ```typescript import { z } from 'zod' const userSchema = z.object({ email: z.string().email().max(255), password: z.string().min(8).max(128), name: z.string().min(1).max(100).regex(/^[a-zA-Z\s'-]+$/), age: z.number().int().min(13).max(150).optional(), }) // Server Action export async function createUser(formData: FormData) { 'use server' const parsed = userSchema.safeParse({ email: formData.get('email'), password: formData.get('password'), name: formData.get('name'), }) if (!parsed.success) { return { error: parsed.error.flatten() } } // Safe to use parsed.data } ``` ### File Upload Validation ```typescript const ALLOWED_TYPES = ['image/jpeg', 'image/png', 'image/webp'] const MAX_SIZE = 5 * 1024 * 1024 // 5MB export async function uploadFile(formData: FormData) { 'use server' const file = formData.get('file') as File if (!file || file.size === 0) return { error: 'No file' } if (!ALLOWED_TYPES.includes(file.type)) return { error: 'Invalid file type' } if (file.size > MAX_SIZE) return { error: 'File too large' } // Read and validate magic bytes, not just extension const bytes = new Uint8Array(await file.arrayBuffer()) if (!validateMagicBytes(bytes, file.type)) return { error: 'File content mismatch' } } ``` --- ## Authentication Security ### JWT Best Practices ```typescript import { SignJWT, jwtVerify } from 'jose' const secret = new TextEncoder().encode(process.env.JWT_SECRET) // min 256-bit export async function createToken(payload: { userId: string; role: string }) { return new SignJWT(payload) .setProtectedHeader({ alg: 'HS256' }) .setIssuedAt() .setExpirationTime('15m') // Short-lived access tokens .setAudience('your-app') .setIssuer('your-app') .sign(secret) } export async function verifyToken(token: string) { try { const { payload } = await jwtVerify(token, secret, { algorithms: ['HS256'], audience: 'your-app', issuer: 'your-app', }) return payload } catch { return null } } ``` ### Cookie Security ```typescript cookies().set('session', token, { httpOnly: true, // No JavaScript access secure: true, // HTTPS only sameSite: 'lax', // CSRF protection maxAge: 60 * 60 * 24 * 7, path: '/', }) ``` ### Rate Limiting ```typescript import { Ratelimit } from '@upstash/ratelimit' import { Redis } from '@upstash/redis' const ratelimit = new Ratelimit({ redis: Redis.fromEnv(), limiter: Ratelimit.slidingWindow(10, '10 s'), }) // In middleware or route handler const ip = request.headers.get('x-forwarded-for') ?? '127.0.0.1' const { success, remaining } = await ratelimit.limit(ip) if (!success) { return NextResponse.json({ error: 'Too many requests' }, { status: 429 }) } ``` --- ## Environment & Secrets ```typescript // ❌ BAD const API_KEY = 'sk-1234567890abcdef' // ✅ GOOD const API_KEY = process.env.API_KEY if (!API_KEY) throw new Error('API_KEY not configured') ``` **Rules:** - Never commit `.env` files (only `.env.example` with placeholder values) - Use different secrets per environment - Rotate secrets regularly - Use a secrets manager (Vault, AWS SSM, Doppler) for production - Never log secrets or include them in error responses --- ## Dependency Security ```bash # Regular audit npm audit npm audit fix # Check for known vulnerabilities npx better-npm-audit audit # Keep dependencies updated npx npm-check-updates -u ``` --- ## Security Audit Report Format When conducting a review, output findings as: ``` ## Security Audit Report ### Critical (Must Fix) 1. **[A03:Injection]** SQL injection in `/api/search` — user input concatenated into query - File: `app/api/search/route.ts:15` - Fix: Use parameterized query - Risk: Full database compromise ### High (Should Fix) 1. **[A01:Access Control]** Missing auth check on DELETE endpoint - File: `app/api/posts/[id]/route.ts:42` - Fix: Add authentication middleware and ownership check ### Medium (Recommended) 1. **[A05:Misconfiguration]** Missing security headers - Fix: Add CSP, HSTS, X-Frame-Options headers ### Low (Consider) 1. **[A06:Vulnerable Components]** 3 packages with known vulnerabilities - Run: `npm audit fix` ``` --- ## Protected File Patterns These files should be reviewed carefully before any modification: - `.env*` — environment secrets - `auth.ts` / `auth.config.ts` — authentication configuration - `middleware.ts` — route protection logic - `**/api/auth/**` — auth endpoints - `prisma/schema.prisma` — database schema (permissions, RLS) - `next.config.*` — security headers, redirects - `package.json` / `package-lock.json` — dependency changes