fix(security): full-escape admin log XSS, gate raw_json/error redaction on admin identity

H1: admin.html appendLog now uses escHtml() (escapes " and ') before the URL
linkifier, closing an attribute-breakout XSS from attacker-controlled URLs in
log lines. Entities inside href are inert, so linkification stays correct.

H2: /api/public/node/:addr and /:addr/errors strip raw_json (operator-internal
diag payload) for anonymous visitors only. raw_json is joined from results
(core/db.js:1111) and the admin failure-diagnostic drawer parses raw.diag/raw.type
from this same endpoint — stripping it unconditionally blanked the operator's
failure report. The strip is now gated on !req.admin.

M2: new _redactPublicError() (bech32 sent1…/sentnode1… → [addr]) applied to the
SSE error path AND the REST error_message on both public node endpoints, so
wallet/granter addresses in stored RPC rawLogs never reach public surfaces.
log_snippet is preserved (already sanitized, Failure-Log UX MUST).

auth: attachAdminFlag now mirrors adminOnly's local-mode bypass — when no
ADMIN_TOKEN is set (single-user install, the operator's primary deployment),
req.admin=true so the operator's own browser keeps raw_json. Previously the two
middlewares disagreed and the local operator was flagged non-admin.

Author: Sentinel-Bluebuilder

admin.html

@@ -2108,7 +2108,11 @@ <h1 style="margin:0;flex:0 0 auto">SENTINEL NODE TEST</h1>
       div.className = 'log-entry ' + cls;
       div.dataset.cat = cat || logCategory(msg);
       const ts = new Date().toLocaleTimeString('en-US', { hour12: false });
-      const escaped = String(msg).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;');
+      // Escape all five HTML-significant chars (incl. " and ') BEFORE linkifying.
+      // Without quote-escaping, an attacker-controlled URL containing a double
+      // quote (e.g. from an untrusted node operator's remote_addrs) would break
+      // out of href="..." into an inline event handler in the admin origin.
+      const escaped = escHtml(String(msg));
       const linkified = escaped.replace(/(https?:\/\/[^\s<]+)/g, (u) => `<a href="${u}" target="_blank" rel="noopener" style="color:var(--accent);text-decoration:underline">${u}</a>`);
       div.innerHTML = `<span class="log-time">${ts}</span>` + linkified;
       if (!_logEntryMatches(div, _logFilter)) div.style.display = 'none';

core/auth.js

@@ -74,8 +74,13 @@ export function adminOnly(req, res, next) {
 // render admin controls without enforcing authentication.
 export function attachAdminFlag(req, res, next) {
   const token = process.env.ADMIN_TOKEN;
+  // No ADMIN_TOKEN configured → local/single-user mode. There are no anonymous
+  // visitors here: the operator IS the admin (PUBLIC_MODE forces ADMIN_TOKEN to
+  // be set before any public deployment). Mirror adminOnly's local-mode bypass
+  // so req.admin is consistent across both middlewares — otherwise the operator's
+  // own browser is flagged non-admin and loses raw_json in the failure drawer.
   if (!token) {
-    req.admin = false;
+    req.admin = true;
     return next();
   }
 

server.js

@@ -1339,6 +1339,27 @@ app.get('/api/public/node/:addr', attachAdminFlag, rlPublicRead, (req, res) => {
     if (!detail.node) {
       return res.status(404).json({ error: 'Node not found' });
     }
+    // Strip raw_json from the PUBLIC response. raw_json is a JSON.stringify of
+    // the full per-node result (diag.wgServerEndpoint, diag.remoteUrl,
+    // sessionId, handshake internals) and must never reach anonymous visitors.
+    // log_snippet (already address-sanitized) is preserved for the Failure-Log UX.
+    // Authenticated admins (req.admin via signed session cookie or bearer token)
+    // KEEP raw_json — the admin failure-diagnostic drawer parses raw.diag/raw.type
+    // from this exact endpoint. Stripping it for everyone blanks the operator's
+    // failure report; the strip must be gated on identity, not applied blindly.
+    if (!req.admin) {
+      const stripRaw = (row) => { if (row && typeof row === 'object') delete row.raw_json; return row; };
+      const stripErr = (row) => {
+        if (row && typeof row === 'object') {
+          delete row.raw_json;
+          if (row.error_message != null) row.error_message = _redactPublicError(row.error_message, 2048);
+        }
+        return row;
+      };
+      if (detail.node) stripRaw(detail.node);
+      if (Array.isArray(detail.history)) detail.history.forEach(stripRaw);
+      if (Array.isArray(detail.errors))  detail.errors.forEach(stripErr);
+    }
     res.json(detail);
   } catch (err) {
     console.error('[api/public/node]', err);
@@ -1356,6 +1377,20 @@ app.get('/api/public/node/:addr/errors', attachAdminFlag, rlPublicRead, (req, re
     const limit  = Math.min(parseInt(req.query.limit || '50', 10) || 50, 500);
     const stage  = req.query.stage || null;
     const errors = getNodeErrors(addr, { limit, stage });
+    // For anonymous visitors: strip raw_json (operator-internal diag payload)
+    // and redact bech32 addresses from error_message (stored verbatim at write
+    // time, so it can carry wallet/granter addresses from RPC rawLogs).
+    // log_snippet stays — it is already address-sanitized and required by the
+    // Failure-Log UX. Authenticated admins (req.admin) see the unredacted rows;
+    // the admin failure drawer parses raw_json from this endpoint.
+    if (!req.admin && Array.isArray(errors)) {
+      for (const row of errors) {
+        if (row && typeof row === 'object') {
+          delete row.raw_json;
+          if (row.error_message != null) row.error_message = _redactPublicError(row.error_message, 2048);
+        }
+      }
+    }
     res.json({ node_addr: addr, total: errors.length, errors });
   } catch (err) {
     console.error('[api/public/node/errors]', err);
@@ -1811,6 +1846,17 @@ const PUBLIC_EVENT_WHITELIST = new Set([
   'progress',
 ]);
 
+// Redact bech32 wallet/granter addresses (sent1…/sentnode1…/sentpub1…/
+// sentvaloper1…) from any error/log string before it reaches a public surface.
+// Mirrors audit/pipeline.js _sanitizeSnippet's address scrub, which is not in
+// scope here. Raw thrown-error / RPC rawLog text can otherwise carry the
+// tester's wallet or a plan owner's granter address.
+const _PUBLIC_ADDR_RE = /\b(sent|sentnode|sentpub|sentvaloper)1[a-z0-9]{6,}\b/gi;
+function _redactPublicError(v, max = 200) {
+  if (v == null) return null;
+  return String(v).replace(_PUBLIC_ADDR_RE, '[addr]').slice(0, max);
+}
+
 // Keep only the counters / progress fields a public viewer needs.
 // Strips wallet, balance*, spent*, MNEMONIC-derived data, errorMessage internals.
 const PUBLIC_STATE_KEYS = [
@@ -1864,7 +1910,7 @@ function sanitizePublicResult(r) {
     peers: r.peers,
     maxPeers: r.maxPeers,
     errorCode: r.errorCode,
-    error: r.error ? String(r.error).slice(0, 200) : null,
+    error: r.error ? _redactPublicError(r.error) : null,
     skipped: r.skipped === true ? true : undefined,
     inPlan: r.inPlan === true ? true : undefined,
     testedAt: r.testedAt,
@@ -1889,7 +1935,7 @@ function sanitizeForPublic(evt) {
   if (evt.passed != null)      safe.passed      = evt.passed;
   if (evt.failed != null)      safe.failed      = evt.failed;
   if (evt.durationMs != null)  safe.durationMs  = evt.durationMs;
-  if (evt.error != null)       safe.error       = String(evt.error).slice(0, 200);
+  if (evt.error != null)       safe.error       = _redactPublicError(evt.error);
   // batch:* event fields — only public-safe node-level data
   if (evt.batchId != null)      safe.batchId      = evt.batchId;
   if (evt.snapshotSize != null) safe.snapshotSize = evt.snapshotSize;