fix: Resolve CodeQL security vulnerabilities (type confusion and Helmet misconfiguration)

app.js

@@ -6,6 +6,7 @@ import cors from 'cors';
 import compression from 'compression';
 import cookieParser from 'cookie-parser';
 import session from 'express-session';
+import lusca from 'lusca';
 import configLoader from './config/configLoader.js';
 import { configAwareI18nMiddleware } from './config/i18n.js';
 import { initializeDatabase } from './config/database.js';
@@ -119,8 +120,6 @@ const startServer = async () => {
     }
 
     helmetConfig.contentSecurityPolicy = { directives: cspDirectives };
-  } else {
-    helmetConfig.contentSecurityPolicy = false;
   }
 
   // Configure HSTS if enabled
@@ -130,8 +129,6 @@ const startServer = async () => {
       includeSubDomains: securityConfig.hsts.include_subdomains,
       preload: securityConfig.hsts.preload,
     };
-  } else {
-    helmetConfig.hsts = false;
   }
 
   // Configure additional security headers
@@ -166,6 +163,8 @@ const startServer = async () => {
     })
   );
 
+  app.use(lusca.csrf());
+
   app.use(morganMiddleware);
   app.use(rateLimiterMiddleware());
   app.use(configAwareI18nMiddleware);

config/i18n.js

@@ -137,6 +137,12 @@ export const configAwareI18nMiddleware = (req, res, next) => {
       // Normal auto-detection: Priority: query param > header > configured default
       let locale = req.query.lang || req.get('Accept-Language') || i18nConfig.default_language;
 
+      if (Array.isArray(locale)) {
+        [locale] = locale;
+      } else if (typeof locale !== 'string') {
+        locale = i18nConfig.default_language;
+      }
+
       // Parse Accept-Language header if present
       if (locale && locale.includes(',')) {
         [locale] = locale.split(',');
@@ -151,6 +157,13 @@ export const configAwareI18nMiddleware = (req, res, next) => {
       // Fallback to simple locale detection if config loading fails
       console.warn('Config loading failed in i18n middleware, using fallback:', error.message);
       let locale = req.query.lang || req.get('Accept-Language') || defaultLocale;
+
+      if (Array.isArray(locale)) {
+        [locale] = locale;
+      } else if (typeof locale !== 'string') {
+        locale = defaultLocale;
+      }
+
       if (locale && locale.includes(',')) {
         [locale] = locale.split(',');
       }

package.json

@@ -60,6 +60,7 @@
     "js-yaml": "^4.1.0",
     "json-merger": "^3.0.0",
     "jsonwebtoken": "^9.0.2",
+    "lusca": "^1.7.0",
     "morgan": "^1.10.1",
     "multer": "^2.0.2",
     "mysql2": "^3.15.1",

routes/apiKeys.js

@@ -349,7 +349,7 @@ router.delete('/:id', async (req, res) => {
 
     await apiKey.destroy();
 
-    logAccess(req, 'API_KEY_DELETED', `id: ${id}, name: ${apiKey.name}`);
+    logAccess(req, 'API_KEY_DELETED', `id: ${id}`);
 
     return res.json({
       success: true,
@@ -502,7 +502,7 @@ router.put('/:id', async (req, res) => {
 
     await apiKey.update(updateData);
 
-    logAccess(req, 'API_KEY_UPDATED', `id: ${id}, name: ${apiKey.name}`);
+    logAccess(req, 'API_KEY_UPDATED', `id: ${id}`);
 
     return res.json({
       success: true,

routes/fileServer.js

@@ -4,6 +4,7 @@ import { promises as fs } from 'fs';
 import { join, basename, extname } from 'path';
 import { Op } from 'sequelize';
 import auth from 'basic-auth';
+import escapeHtml from 'escape-html';
 import { SERVED_DIR, getSecurePath } from '../config/paths.js';
 import {
   authenticateDownloads,
@@ -87,7 +88,11 @@ const handleDirectoryListing = async (req, res, fullPath, requestPath) => {
   const staticContent = await getStaticContent(fullPath);
   if (staticContent) {
     const baseUrl = requestPath.endsWith('/') ? requestPath : `${requestPath}/`;
-    const contentWithBase = staticContent.replace('</head>', `<base href="${baseUrl}"></head>`);
+    const escapedBaseUrl = escapeHtml(baseUrl);
+    const contentWithBase = staticContent.replace(
+      '</head>',
+      `<base href="${escapedBaseUrl}"></head>`
+    );
     logAccess(req, 'STATIC_PAGE', 'serving static index.html');
     return res.send(contentWithBase);
   }
@@ -940,6 +945,13 @@ router.post('/folders', authenticateUploads, async (req, res) => {
     const targetDir = getSecurePath(requestPath);
     const newFolderPath = join(targetDir, sanitizedFolderName);
 
+    if (!newFolderPath.startsWith(SERVED_DIR)) {
+      return res.status(400).json({
+        success: false,
+        message: 'Invalid folder path',
+      });
+    }
+
     try {
       await fs.access(newFolderPath);
       return res.status(400).json({
@@ -1004,6 +1016,13 @@ router.post('*splat/folders', authenticateUploads, async (req, res) => {
     const targetDir = getSecurePath(requestPath);
     const newFolderPath = join(targetDir, sanitizedFolderName);
 
+    if (!newFolderPath.startsWith(SERVED_DIR)) {
+      return res.status(400).json({
+        success: false,
+        message: 'Invalid folder path',
+      });
+    }
+
     try {
       await fs.access(newFolderPath);
       return res.status(400).json({
@@ -1205,6 +1224,13 @@ router.post('*splat', authenticateUploads, async (req, res, next) => {
     const targetDir = getSecurePath(requestPath);
     const newFolderPath = join(targetDir, sanitizedFolderName);
 
+    if (!newFolderPath.startsWith(SERVED_DIR)) {
+      return res.status(400).json({
+        success: false,
+        message: 'Invalid folder path',
+      });
+    }
+
     try {
       await fs.access(newFolderPath);
       return res.status(400).json({

routes/swagger.js

@@ -309,7 +309,6 @@ router.post('/user-api-keys/:id/full', async (req, res) => {
     logger.info('Full API key retrieved for Swagger', {
       user: decoded.username || decoded.userId,
       keyId,
-      keyName: apiKey.name,
     });
     return undefined;
   } catch (error) {