Security Audit: Dependency & Supply Chain Vulnerabilities

[SH20RAJ]

Security audit findings

[SH20RAJ]

Security Audit Report

Critical Findings

1. CSP Policy Allows unsafe-eval in Non-Production

   • File: apps/web/lib/csp.ts:24
   • Issue: Non-production CSP includes 'unsafe-eval' in script-src, allowing arbitrary code execution via eval()
   • Fix: Remove 'unsafe-eval' from non-production CSP

2. Insecure API Key Generation Using Math.random()

   • File: apps/web/components/apps/make/Setup.tsx:38
   • Issue: Math.random() is NOT cryptographically secure for generating API keys
   • Fix: Use crypto.randomBytes() instead

3. Insecure Random String Generator

   • File: packages/lib/random.ts:11
   • Issue: Utility function uses Math.random() for random strings
   • Fix: Use crypto.randomInt() instead

High Findings

4. Widespread credential.key Access

   • Files: 30+ files
   • Issue: credential.key accessed directly; risk of leaking OAuth tokens
   • Fix: Enforce select queries excluding credential.key

5. Raw SQL Queries Without Parameterization Audit

   • Files: Multiple $queryRaw usages
   • Issue: Potential SQL injection if user input reaches these queries
   • Fix: Audit all $queryRaw calls

6. dangerouslySetInnerHTML Usage (28 instances)

   • Files: Multiple
   • Issue: XSS risk if unsanitized data reaches these components
   • Fix: Audit each usage; ensure DOMPurify sanitization

7. MD5 Usage for Hashing

   • Files: packages/trpc/server/routers/viewer/me/get.handler.ts:122
   • Issue: MD5 is cryptographically broken
   • Fix: Use SHA-256

Medium Findings

8. Deprecated Dependency: @faker-js/faker

   • Version: 9.2.0
   • Issue: Flagged by yarn npm audit as deprecated

9. Unpinned "latest" Version Dependencies

   • Files: package.json:101, apps/api/v2/package.json:64
   • Issue: "latest" allows automatic updates to potentially compromised versions
   • Fix: Pin to specific versions

10. No Rate Limiting on Most tRPC Endpoints

    • Issue: Rate limiting middleware exists but is disabled
    • Fix: Enable rate limiting on authentication endpoints

PRs Created (on fork)

• PR The getIntegrations function runs repeatedly due to state polling #1: CSP Security Hardening
• PR When navigating to a calendso user that does not exist, return notFound. #2: Replace Math.random() with Crypto
• PR Unable to login if running on custom port #4: Pin Latest Dependencies

Full Report

See /tmp/dep-audit-findings.md for complete details.

🤖 Generated with OpenClaude