mirror of
https://github.com/Ride-The-Lightning/RTL.git
synced 2026-08-13 12:33:07 +02:00
e617fbb561
csurf has been deprecated since 2022 and pins an old cookie release with a known advisory; npm's only fix is a downgrade (issue #1634, item 2). csrf-csrf v4 implements the same double-submit-cookie pattern with an HMAC-signed, session-bound token keyed on the existing boot secret (common.secret_key). The frontend contract is unchanged: the token still arrives via the XSRF-TOKEN cookie/header and is echoed as x-xsrf-token (all token sources csurf accepted are still read), the signed cookie keeps the _csrf name (now httpOnly, secure:false to match the session cookie on plain-HTTP deployments), doubleCsrfProtection attaches req.csrfToken so app.ts keeps working, and the error code is EBADCSRFTOKEN - already handled in app.ts. The websocket upgrade check in authCheck.ts now routes through the shared middleware; upgrade requests are GETs, so its pass-through semantics are unchanged. One fix this surfaced: app.ts called req.csrfToken() twice (cookie and header). Under csurf every token validated against a stable secret; under csrf-csrf each first-visit call mints a new token, desyncing the XSRF-TOKEN cookie from the _csrf cookie it must equal. The token is now generated once per request. Tokens are session-bound, so a token stolen from one session no longer validates in another - a check csurf's cookie mode did not perform. Production npm audit drops from 6 low findings to 4, all in the crypto-browserify/elliptic chain tracked in #1634. Verified against the docker regtest fixture: both API suites (43 checks across LND, CLN and Eclair) plus a dedicated CSRF battery - valid-token auth, missing token 403, garbage token 403, cross-session replay 403, token stability across requests, the XSRF-TOKEN response header for Quickpay, and the websocket handshake. Lint and build are clean.
110 lines
3.6 KiB
JSON
110 lines
3.6 KiB
JSON
{
|
|
"name": "rtl",
|
|
"version": "0.15.9-beta",
|
|
"license": "MIT",
|
|
"type": "module",
|
|
"scripts": {
|
|
"ng": "ng",
|
|
"start": "ng serve --open",
|
|
"prebuildfrontendtest": "node src/prebuild.cjs",
|
|
"prebuildfrontend": "node src/prebuild.cjs",
|
|
"watchfrontenddev": "ng build --configuration development --optimization false --watch",
|
|
"buildfrontendtest": "ng test --watch=false && ng build",
|
|
"buildfrontend": "ng build --configuration production",
|
|
"buildbackend": "npx tsc --project ./server/tsconfig.server.json",
|
|
"watchbackend": "npx tsc --project ./server/tsconfig.server.json --watch",
|
|
"server": "set NODE_ENV=development&&nodemon --watch backend --watch server ./rtl.js",
|
|
"serverUbuntu": "NODE_ENV=development nodemon --watch backend --watch server ./rtl.js",
|
|
"testdev": "ng test --watch=true --code-coverage",
|
|
"test": "ng test --watch=false --browsers=ChromeHeadless",
|
|
"lint": "eslint"
|
|
},
|
|
"private": true,
|
|
"dependencies": {
|
|
"@ngrx/effects": "21.0.1",
|
|
"@ngrx/store": "21.0.1",
|
|
"@swimlane/ngx-charts": "23.1.0",
|
|
"angular-user-idle": "4.0.0",
|
|
"atob": "2.1.2",
|
|
"axios": "1.16.0",
|
|
"buffer": "6.0.3",
|
|
"cookie-parser": "1.4.7",
|
|
"crypto-browserify": "3.12.1",
|
|
"csrf-csrf": "4.0.3",
|
|
"express": "5.2.1",
|
|
"express-session": "1.18.2",
|
|
"hocon-parser": "1.0.1",
|
|
"ini": "6.0.0",
|
|
"jsonwebtoken": "9.0.3",
|
|
"ng-qrcode": "21.0.0",
|
|
"ngx-perfect-scrollbar-next": "10.1.1",
|
|
"otplib": "12.0.1",
|
|
"pdfmake": "0.3.11",
|
|
"process": "0.11.10",
|
|
"rxjs": "7.8.2",
|
|
"sha256": "0.2.0",
|
|
"socket.io-client": "4.8.3",
|
|
"stream-browserify": "3.0.0",
|
|
"tslib": "2.8.1",
|
|
"vm-browserify": "1.1.2",
|
|
"ws": "8.21.0",
|
|
"zone.js": "0.16.0"
|
|
},
|
|
"devDependencies": {
|
|
"@angular-devkit/build-angular": "20.3.32",
|
|
"@angular-eslint/builder": "20.7.0",
|
|
"@angular-eslint/eslint-plugin": "20.7.0",
|
|
"@angular-eslint/eslint-plugin-template": "20.7.0",
|
|
"@angular-eslint/schematics": "20.7.0",
|
|
"@angular-eslint/template-parser": "20.7.0",
|
|
"@angular/animations": "20.3.26",
|
|
"@angular/build": "20.3.32",
|
|
"@angular/cdk": "20.2.14",
|
|
"@angular/cli": "20.3.32",
|
|
"@angular/common": "20.3.26",
|
|
"@angular/compiler": "20.3.26",
|
|
"@angular/compiler-cli": "20.3.26",
|
|
"@angular/core": "20.3.26",
|
|
"@angular/flex-layout": "15.0.0-beta.42",
|
|
"@angular/forms": "20.3.26",
|
|
"@angular/material": "20.2.14",
|
|
"@angular/platform-browser": "20.3.26",
|
|
"@angular/platform-browser-dynamic": "20.3.26",
|
|
"@angular/router": "20.3.26",
|
|
"@eslint/eslintrc": "3.3.3",
|
|
"@fortawesome/angular-fontawesome": "4.0.0",
|
|
"@fortawesome/fontawesome-svg-core": "7.1.0",
|
|
"@fortawesome/free-regular-svg-icons": "7.1.0",
|
|
"@fortawesome/free-solid-svg-icons": "7.1.0",
|
|
"@ngrx/store-devtools": "21.0.1",
|
|
"@types/jasmine": "5.1.15",
|
|
"@types/node": "20.19.30",
|
|
"@typescript-eslint/eslint-plugin": "8.53.0",
|
|
"@typescript-eslint/parser": "8.53.0",
|
|
"dotenv": "17.2.3",
|
|
"eslint": "9.39.2",
|
|
"eslint-plugin-deprecation": "3.0.0",
|
|
"jasmine-core": "5.13.0",
|
|
"jasmine-spec-reporter": "7.0.0",
|
|
"karma": "6.4.4",
|
|
"karma-chrome-launcher": "3.2.0",
|
|
"karma-coverage": "2.2.1",
|
|
"karma-jasmine": "5.1.0",
|
|
"karma-jasmine-html-reporter": "2.1.0",
|
|
"material-icons": "1.13.14",
|
|
"nodemon": "3.1.11",
|
|
"protractor": "7.0.0",
|
|
"roboto-fontface": "0.10.0",
|
|
"ts-node": "10.9.2",
|
|
"typescript": "5.8.3"
|
|
},
|
|
"overrides": {
|
|
"chalk": "4.1.0",
|
|
"strip-ansi": "6.0.1",
|
|
"color-convert": "2.0.1",
|
|
"color-name": "1.1.4",
|
|
"is-core-module": "2.13.0",
|
|
"error-ex": "1.3.2",
|
|
"has-ansi": "2.1.1"
|
|
}
|
|
}
|