fix: address all open CodeQL security alerts#480

Merged

marcoscaceres merged 29 commits into

mainfrom

fix/codeql-security-alerts

Apr 25, 2026

Commits on Apr 25, 2026

fix: replace Helmet frameguard:false with CSP frame-ancestors for iframe embedding
marcoscaceres
committed
fix: add sliding-window rate limiting to /respec/size routes
marcoscaceres
committed
chore: suppress intentional code-injection false positive in xref filter worker
marcoscaceres
committed
test: add tests for rate-limit utility and SSRF URL validation
marcoscaceres
committed
chore: fix CodeQL suppression syntax; remove redundant comment in app.ts
marcoscaceres
committed
chore: simplify worker.js comment; alerts dismissed via security dashboard
marcoscaceres
committed
fix(rate-limit): throw RangeError for invalid windowMs or max options
marcoscaceres
committed
revert: stop touching worker.js; alert #21 dismissed via dashboard, not in PR diff
marcoscaceres
committed
fix(rate-limit): compute sliding-window Retry-After precisely

Copilot
authored and
marcoscaceres
committed
test: use os.tmpdir for DATA_DIR in env helper

Copilot
authored and
marcoscaceres
committed
test(rate-limit): stabilize Retry-After test spy usage

Copilot
authored and
marcoscaceres
committed
test: restore Date.now spy cleanup in rate-limit specs

Copilot
authored and
marcoscaceres
committed
test: make Retry-After spy values fully deterministic

Copilot
authored and
marcoscaceres
committed
fix(helmet): disable frameguard so CSP frame-ancestors controls iframe embedding alone
marcoscaceres
committed
fix: tighten respec rate limit and remove realtime wait in test

Copilot
authored and
marcoscaceres
committed
fix: keep precise Retry-After math and clarify mocked expiry timestamp

Copilot
authored and
marcoscaceres
committed
fix: use express-rate-limit, tighten CSP and SSRF checks
marcoscaceres
committed
fix: address Copilot review findings
marcoscaceres
committed
fix: address Sid's review comments
marcoscaceres
committed
test: add smoke tests for rate-limit re-export
marcoscaceres
committed
test: add behavior tests for rate limiting middleware
marcoscaceres
committed
fix: override html-minifier with html-minifier-terser
marcoscaceres
committed
fix(helmet): remove frame-ancestors from default CSP
marcoscaceres
committed
test: assert Retry-After header on 429 response
marcoscaceres
committed
fix: reject non-https schemes in SSRF check, expand tests
marcoscaceres
committed
chore: regenerate lockfile after dep-updates merge
marcoscaceres
committed
fix: address Sid's review comments on PR #480
marcoscaceres
committed
refactor: replace tryURL with native URL.parse()
marcoscaceres
committed
refactor: inline express-rate-limit import, remove wrapper
marcoscaceres
committed