Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

🛡️ fix: Minor Vulnerabilities #4543

Merged
merged 14 commits into from
Oct 24, 2024
Merged

🛡️ fix: Minor Vulnerabilities #4543

merged 14 commits into from
Oct 24, 2024

Conversation

danny-avila
Copy link
Owner

@danny-avila danny-avila commented Oct 24, 2024

Summary

I implemented comprehensive security improvements across multiple components, focusing on file management, authentication, and data processing to prevent vulnerabilities and enhance data protection.

  • Added ownership validation to file deletion process to ensure users can only delete their own files
  • Implemented protection against mass assignment in preset updates by excluding user field
  • Enhanced regex security by adding proper escaping for special characters in name searches
  • Added robust ObjectId validation for image requests with length and pattern checks
  • Improved citation processing to prevent ReDoS vulnerabilities in ChatGPT imports
  • Moved utility functions to appropriate modules for better code organization
  • Created comprehensive test suite for citation handling and ReDoS prevention
  • Added real-world ChatGPT data tests for citation processing validation
  • Added a proper role access check for creating Prompts

Change Type

  • Bug fix (non-breaking change which fixes an issue)
  • This change requires a documentation update

Checklist

  • My code adheres to this project's style guidelines
  • I have performed a self-review of my own code
  • I have commented in any complex areas of my code
  • I have written tests demonstrating that my changes are effective
  • Local unit tests pass with my changes

@danny-avila danny-avila merged commit 3f3b592 into main Oct 24, 2024
4 checks passed
@danny-avila danny-avila deleted the fix/minor-vulns branch October 24, 2024 19:50
owengo pushed a commit to openwengo/LibreChat that referenced this pull request Oct 25, 2024
* fix: ReDoS in ChatGPT Import

* ci: should correctly process citations from real ChatGPT data

* ci: Add ReDoS vulnerability test for processAssistantMessage

* refactor: Update thread management and citation handling

* refactor(validateImageRequest): robust validation

* refactor(Prompt.js): update name search regex to escape special characters

* refactor(Preset): exclude user from preset update to prevent mass assignment

* refactor(files.js): Improve file deletion process

* ci: updated validateImageRequest.spec.js

* a11y: plugin pagination

* refactor(CreatePromptForm.tsx): Improve input field styling

* chore(Prompts): typing and accessibility

* fix: prompt creation access role check

* chore: remove duplicate jsdocs
danny-avila added a commit that referenced this pull request Oct 27, 2024
* fix: ReDoS in ChatGPT Import

* ci: should correctly process citations from real ChatGPT data

* ci: Add ReDoS vulnerability test for processAssistantMessage

* refactor: Update thread management and citation handling

* refactor(validateImageRequest): robust validation

* refactor(Prompt.js): update name search regex to escape special characters

* refactor(Preset): exclude user from preset update to prevent mass assignment

* refactor(files.js): Improve file deletion process

* ci: updated validateImageRequest.spec.js

* a11y: plugin pagination

* refactor(CreatePromptForm.tsx): Improve input field styling

* chore(Prompts): typing and accessibility

* fix: prompt creation access role check

* chore: remove duplicate jsdocs
BertKiv pushed a commit to BertKiv/LibreChat that referenced this pull request Dec 10, 2024
* fix: ReDoS in ChatGPT Import

* ci: should correctly process citations from real ChatGPT data

* ci: Add ReDoS vulnerability test for processAssistantMessage

* refactor: Update thread management and citation handling

* refactor(validateImageRequest): robust validation

* refactor(Prompt.js): update name search regex to escape special characters

* refactor(Preset): exclude user from preset update to prevent mass assignment

* refactor(files.js): Improve file deletion process

* ci: updated validateImageRequest.spec.js

* a11y: plugin pagination

* refactor(CreatePromptForm.tsx): Improve input field styling

* chore(Prompts): typing and accessibility

* fix: prompt creation access role check

* chore: remove duplicate jsdocs
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant