Security review (2026-05-18): SEC-16 transitive kysely vuln, fixed inline#167
Merged
Conversation
…line Whole-repo review for the 2026-05-18 round. Added SEC-16 for the kysely JSON-path traversal CVE (GHSA-pv5w-4p9q-p3v2) carried in transitively by better-auth via kysely@0.28.16; closed inline with a `kysely: ^0.28.17` override so every transitive resolution snaps to the fixed version. The vulnerable code path (JSONPathBuilder.key()/.at()) is not reachable from our application code or from better-auth's kysely-adapter, so practical risk is Low — but keeping `bun audit` clean is the dependency-hygiene signal we rely on between rounds. Also closed the prior round's last systematic scope gap by walking every optionalAuth route under competition-api for PII columns — only SEC-15's pilot-list leak was real and is still fixed. The new user-files and preferences endpoints (PR #163, #165) audit clean: requireAuth on every mutation, bounded validators (Zod + regex), parameterised SQL, and the existing IGC size caps (validateAndDecompressIgc) carried over. bun audit: 0 vulnerabilities post-fix. All tests pass.
|
Preview Deployment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Whole-repo security review for the 2026-05-18 round, appended to
docs/security-review.md.kysely@0.28.16carried in transitively bybetter-auth(GHSA-pv5w-4p9q-p3v2, JSON-path traversal). Our directkyselyis already at0.28.17, but the transitive copy bypassed it."kysely": "^0.28.17"to thepackage.jsonoverridesblock. Post-fix the lockfile contains a singlekysely@0.28.17entry andbun auditreports 0 vulnerabilities.JSONPathBuilder.key()/.at()) is not used by our code or by better-auth'skysely-adapter(greps clean). The advisory's High CVSS still warrants the fix to keepbun auditclean as our weekly dependency-hygiene signal.optionalAuthroute undercompetition-api/src/routes/(comp, task, igc, audit, score, pilot-status, pilot, user-files). Only SEC-15's pilot-list leak was real, and it remains fixed./api/user/*(8 routes),/api/u/:username/*(3 public-by-link reads),/api/auth/preferences(2 routes). All enforce auth via the SEC-10 service-binding pattern, bounded validation (Zod + regex), and parameterised SQL.Prior findings status
All Critical/High findings remain Fixed:
Still Open and small-diff (carried forward, none urgent):
_headersfile), SEC-03 (admin emails), SEC-05 (innerHTML pattern), SEC-06 (bodyLimit), SEC-08 (rate-limit headers), SEC-13 (sw.js filename sanitisation).Test plan
bun audit— 0 vulnerabilities post-fixbun run typecheck:all— greenbun run test:all— 251 competition-api + 21 mcp-api + engine tests passingkysely@0.28.17entry inbun.lock(verifiedgrep "kysely@" bun.lock)See the appended 2026-05-18 section in
docs/security-review.mdfor the full round, including the optionalAuth audit table, status of every prior SEC-NN, and the carry-forward scope gaps.https://claude.ai/code/session_01CSLsnj6nLR3sdeZoXhBTvd
Generated by Claude Code