sickn33/agentic-awesome-skills/security-and-hardening

// BAD: SQL injection via string concatenation
const query = `SELECT * FROM users WHERE id = '${userId}'`;
// GOOD: Parameterized query
const user = await db.query('SELECT * FROM users WHERE id = $1', [userId]);
// GOOD: ORM with parameterized input
const user = await prisma.user.findUnique({ where: { id: userId } });

// Password hashing
import { hash, compare } from 'bcrypt';
const SALT_ROUNDS = 12;
const hashedPassword = await hash(plaintext, SALT_ROUNDS);
const isValid = await compare(plaintext, hashedPassword);
// Session management: require trusted proxy/TLS configuration when appropriate,
// rotate the session identifier on login/privilege changes and enforce revocation.
app.use(session({
  secret: requiredSessionSecret,  // validate high-entropy configured secret at startup
  store: productionSessionStore, // do not use express-session MemoryStore in production
  resave: false,
  saveUninitialized: false,
  cookie: {
    httpOnly: true,     // Not accessible via JavaScript
    secure: true,       // HTTPS only
    sameSite: 'lax',    // Defense in depth; add CSRF protection for cookie-authenticated writes
    maxAge: 24 * 60 * 60 * 1000,  // 24 hours
  },
}));

// BAD: Rendering user input as HTML
element.innerHTML = userInput;
// GOOD: Use framework auto-escaping (React does this by default)
return <div>{userInput}</div>;
// If you MUST render HTML, sanitize first
import DOMPurify from 'dompurify';
const clean = DOMPurify.sanitize(userInput);

// Always check authorization, not just authentication
app.patch('/api/tasks/:id', authenticate, async (req, res) => {
  const task = await taskService.findById(req.params.id);
  // Check that the authenticated user owns this resource
  if (!task || task.ownerId !== req.user.id) {
    return res.status(403).json({
      error: { code: 'FORBIDDEN', message: 'Not authorized to modify this task' }
    });
  }
  // Proceed with update
  const input = UpdateTaskSchema.safeParse(req.body); // Schema allowlists mutable fields only.
  if (!input.success) return res.status(422).json({ error: 'Invalid input' });
  // The service must atomically enforce ownerId in its update predicate.
  const updated = await taskService.updateOwned(req.params.id, req.user.id, input.data);
  return res.json(updated);
});

// Security headers (use helmet for Express)
import helmet from 'helmet';
app.use(helmet());
// Content Security Policy
app.use(helmet.contentSecurityPolicy({
  directives: {
    defaultSrc: ["'self'"],
    scriptSrc: ["'self'"],
    styleSrc: ["'self'", "'unsafe-inline'"],  // Tighten if possible
    imgSrc: ["'self'", 'data:', 'https:'],
    connectSrc: ["'self'"],
  },
}));
// CORS — restrict to known origins
app.use(cors({
  origin: approvedOrigins, // validate an explicit nonempty production list at startup
  // No implicit development-origin fallback in production.
  credentials: true,
}));

// Never return sensitive fields in API responses
function sanitizeUser(user: UserRecord): PublicUser {
  return { id: user.id, displayName: user.displayName }; // Explicit public-field allowlist.
}
// Use environment variables for secrets
const API_KEY = process.env.STRIPE_API_KEY;
if (!API_KEY) throw new Error('STRIPE_API_KEY not configured');

// BAD: fetch whatever the user gives you
await fetch(req.body.webhookUrl);
// PARTIAL CHECK ONLY: this has the DNS rebinding gap described below.
// Do not deploy the direct fetch as a complete SSRF defense.
import { lookup } from 'node:dns/promises';
import ipaddr from 'ipaddr.js';
const ALLOWED_HOSTS = new Set(['hooks.example.com']);
async function assertSafeUrl(raw: string): Promise<URL> {
  const url = new URL(raw);
  if (url.protocol !== 'https:' || url.username || url.password || (url.port && url.port !== '443')) {
    throw new Error('https only; no credentials or alternate ports');
  }
  if (!ALLOWED_HOSTS.has(url.hostname)) throw new Error('host not allowed');
  // Resolve ALL records; a single private/reserved address fails the check.
  const addrs = await lookup(url.hostname, { all: true });
  if (!addrs.length || addrs.some((a) => ipaddr.process(a.address).range() !== 'unicast')) {
    throw new Error('private/reserved IP');
  }
  return url;
}
await fetch(await assertSafeUrl(req.body.webhookUrl), { redirect: 'error' });

import { z } from 'zod';
const CreateTaskSchema = z.object({
  title: z.string().trim().min(1).max(200),
  description: z.string().max(2000).optional(),
  priority: z.enum(['low', 'medium', 'high']).default('medium'),
  dueDate: z.string().datetime().optional(),
});
// Validate at the route handler
app.post('/api/tasks', authenticate, async (req, res) => {
  const result = CreateTaskSchema.safeParse(req.body);
  if (!result.success) {
    return res.status(422).json({
      error: {
        code: 'VALIDATION_ERROR',
        message: 'Invalid input',
        details: result.error.flatten(),
      },
    });
  }
  // result.data is now typed and validated
  // Authenticated tenant/owner come from the server, never writable request fields.
  const task = await taskService.createOwned(req.user.tenantId, req.user.id, result.data);
  return res.status(201).json(task);
});

// Restrict file types and sizes
const ALLOWED_TYPES = ['image/jpeg', 'image/png', 'image/webp'];
const MAX_SIZE = 5 * 1024 * 1024; // 5MB