fix(db): add security validation to studio proxy

- Validate port as number to prevent XSS injection
- Validate path to prevent SSRF and path traversal
- Add try/catch for HTML fetch
- Add missing content types for png/ico
- Simplify D1/libsql driver selection logic

Author: onmax

src/db/runtime/api/studio.get.dev.ts

@@ -1,18 +1,29 @@
 // Proxy Drizzle Studio frontend to avoid CORS/Private Network Access issues
 // Serving from localhost allows connecting to localhost:4983 without browser blocking
 
-export default defineEventHandler(async (event) => {
+import { eventHandler, getQuery, setHeader, createError } from 'h3'
+
+export default eventHandler(async (event) => {
   const query = getQuery(event)
-  const port = query.port || 4983
+
+  // Validate port to prevent XSS injection
+  const port = parseInt(String(query.port)) || 4983
+  if (port < 1 || port > 65535) {
+    throw createError({ statusCode: 400, message: 'Invalid port' })
+  }
+
   // Get path without query string
   const fullPath = event.path?.split('?')[0] || ''
   const path = fullPath.replace('/api/_hub/studio', '') || '/'
 
+  // Validate path to prevent SSRF and path traversal
+  if (path !== '/' && (!/^\/[a-zA-Z0-9._-]+$/.test(path) || path.includes('..'))) {
+    throw createError({ statusCode: 400, message: 'Invalid path' })
+  }
 
   // Proxy asset requests (JS, CSS, etc.)
   if (path !== '/' && path !== '') {
     try {
-      // Use text for JS/CSS, blob for binary
       const isBinary = path.endsWith('.svg') || path.endsWith('.png') || path.endsWith('.ico')
       const asset = await $fetch(`https://local.drizzle.studio${path}`, {
         responseType: isBinary ? 'blob' : 'text'
@@ -22,17 +33,24 @@ export default defineEventHandler(async (event) => {
       if (path.endsWith('.js')) setHeader(event, 'Content-Type', 'application/javascript')
       else if (path.endsWith('.css')) setHeader(event, 'Content-Type', 'text/css')
       else if (path.endsWith('.svg')) setHeader(event, 'Content-Type', 'image/svg+xml')
+      else if (path.endsWith('.png')) setHeader(event, 'Content-Type', 'image/png')
+      else if (path.endsWith('.ico')) setHeader(event, 'Content-Type', 'image/x-icon')
 
       return asset
-    } catch (error: any) {
-      throw createError({ statusCode: 502, message: `Failed to fetch studio asset: ${path}` })
+    } catch {
+      throw createError({ statusCode: 502, message: 'Failed to fetch studio asset' })
     }
   }
 
   // Fetch the Drizzle Studio HTML
-  const html = await $fetch<string>('https://local.drizzle.studio/', {
-    headers: { 'Accept': 'text/html' }
-  })
+  let html: string
+  try {
+    html = await $fetch<string>('https://local.drizzle.studio/', {
+      headers: { 'Accept': 'text/html' }
+    })
+  } catch {
+    throw createError({ statusCode: 502, message: 'Failed to fetch Drizzle Studio' })
+  }
 
   // Rewrite asset paths to go through our proxy
   let modifiedHtml = html

src/db/setup.ts

@@ -49,19 +49,12 @@ export async function resolveDatabaseConfig(nuxt: Nuxt, hub: HubConfig): Promise
         }
         break
       }
-      // Cloudflare D1
-      if (hub.hosting.includes('cloudflare')) {
-        if (nuxt.options.dev) {
-          // Use libsql in dev mode since D1 bindings don't exist locally
-          config.driver = 'libsql'
-          config.connection = defu(config.connection, { url: `file:${join(hub.dir!, 'db/sqlite.db')}` })
-          await mkdir(join(hub.dir, 'db'), { recursive: true })
-        } else {
-          config.driver = 'd1'
-        }
+      // Cloudflare D1 (production only - dev mode uses local libsql)
+      if (hub.hosting.includes('cloudflare') && !nuxt.options.dev) {
+        config.driver = 'd1'
         break
       }
-      // Local SQLite
+      // Local SQLite (libsql) - used for local dev including cloudflare preset
       config.driver ||= 'libsql'
       config.connection = defu(config.connection, { url: `file:${join(hub.dir!, 'db/sqlite.db')}` })
       await mkdir(join(hub.dir, 'db'), { recursive: true })