Security audit

Author: deployor

app/actions/blur-requests.ts

@@ -172,17 +172,6 @@ export async function submitBlurRequests(submissions: BlurSubmission[]) {
         blurredS3Key,
         blurredThumbnailS3Key: thumbnailS3Key,
       });
-      await db
-        .update(media)
-        .set({
-          blurStatus: "pending",
-          originalS3Key: item.originalS3Key ?? item.s3Key,
-          originalThumbnailS3Key:
-            item.originalThumbnailS3Key ?? item.thumbnailS3Key,
-          blurredS3Key,
-          blurredThumbnailS3Key: thumbnailS3Key,
-        })
-        .where(eq(media.id, item.id));
       await auditLog(user.id, "create", "blur_request", requestId, {
         mediaId: item.id,
       });

app/actions/bulk.ts

@@ -19,6 +19,12 @@ import { parseSlackIds } from "@/lib/slack-id";
 export async function getBulkMediaUrls(s3Keys?: string[], mediaIds?: string[]) {
   try {
     const urls: Record<string, string> = {};
+    const session = await getSession();
+    const user = await getUserContext(session?.id);
+    if (!user) return { success: false, error: "Unauthorized" };
+    if ((s3Keys?.length ?? 0) > 500 || (mediaIds?.length ?? 0) > 500) {
+      return { success: false, error: "Too many media requested" };
+    }
     if (s3Keys && s3Keys.length > 0) {
       const uniqueKeys = Array.from(new Set(s3Keys));
       const mediaItems = await db.query.media.findMany({
@@ -27,24 +33,22 @@ export async function getBulkMediaUrls(s3Keys?: string[], mediaIds?: string[]) {
           id: true,
           thumbnailS3Key: true,
         },
+        with: { event: true },
       });
-      const mediaByThumbnailKey = new Map(
-        mediaItems
-          .filter((item) => item.thumbnailS3Key)
-          .map((item) => [item.thumbnailS3Key!, item.id]),
-      );
+      const mediaByThumbnailKey = new Map<string, string>();
+      for (const item of mediaItems) {
+        if (item.thumbnailS3Key && (await can(user, "view", "media", item))) {
+          mediaByThumbnailKey.set(item.thumbnailS3Key, item.id);
+        }
+      }
       for (const key of uniqueKeys) {
-        const mediaId =
-          mediaByThumbnailKey.get(key) ??
-          key.match(/^media\/([^/]+)\/thumbnail\.jpg$/)?.[1];
+        const mediaId = mediaByThumbnailKey.get(key);
         if (mediaId) {
           urls[key] = getMediaProxyUrl(mediaId, "thumbnail");
         }
       }
     }
     if (mediaIds && mediaIds.length > 0) {
-      const session = await getSession();
-      const user = await getUserContext(session?.id);
       const mediaItems = await db.query.media.findMany({
         where: inArray(media.id, mediaIds),
         with: {

app/actions/data-export.ts

@@ -1,7 +1,7 @@
 "use server";
 import { randomBytes } from "node:crypto";
-import { createWriteStream } from "node:fs";
-import { readFile, unlink } from "node:fs/promises";
+import { createReadStream, createWriteStream } from "node:fs";
+import { stat, unlink } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { ZipArchive } from "archiver";
@@ -22,6 +22,8 @@ const DATA_EXPORT_REDACTED_KEYS = new Set([
   "hcaRefreshToken",
   "inviteCode",
 ]);
+const MAX_EXPORT_MEDIA_FILES = 5000;
+const MAX_EXPORT_MEDIA_BYTES = 20 * 1024 * 1024 * 1024;
 
 function redactDataExportValue(key: string, value: unknown) {
   if (DATA_EXPORT_REDACTED_KEYS.has(key)) return undefined;
@@ -172,6 +174,18 @@ async function processDataExport(exportId: string, userId: string) {
     const jsonContent = JSON.stringify(safeUserData, null, 2);
     archive.append(jsonContent, { name: "user-data.json" });
     const mediaItems = userData.uploadedMedia || [];
+    const totalMediaBytes = mediaItems.reduce(
+      (sum, item) => sum + (item.fileSize || 0),
+      0,
+    );
+    if (
+      mediaItems.length > MAX_EXPORT_MEDIA_FILES ||
+      totalMediaBytes > MAX_EXPORT_MEDIA_BYTES
+    ) {
+      archive.abort();
+      await unlink(tempPath).catch(() => {});
+      throw new Error("Data export too large");
+    }
     for (const [index, item] of mediaItems.entries()) {
       if (index % 5 === 0) {
         const currentExport = await db.query.dataExports.findFirst({
@@ -193,12 +207,11 @@ async function processDataExport(exportId: string, userId: string) {
         });
         const response = await s3Client.send(command);
         if (response.Body) {
-          const bytes = await response.Body.transformToByteArray();
           const folder = item.mimeType.startsWith("image/")
             ? "photos"
             : "videos";
           const zipPath = `media/${folder}/${safeFilename(item.filename)}`;
-          archive.append(Buffer.from(bytes), {
+          archive.append(response.Body as NodeJS.ReadableStream & any, {
             name: zipPath,
             date:
               item.uploadedAt instanceof Date
@@ -217,14 +230,14 @@ async function processDataExport(exportId: string, userId: string) {
       archive.on("error", reject);
     });
     const s3Key = `exports/${exportId}/archive.zip`;
-    const fileBuffer = await readFile(tempPath);
+    const fileStats = await stat(tempPath);
     await uploadToS3(
-      fileBuffer,
+      createReadStream(tempPath),
       s3Key,
       "application/zip",
       undefined,
       undefined,
-      fileBuffer.length,
+      fileStats.size,
     );
     try {
       await db

app/actions/events.ts

@@ -400,6 +400,11 @@ export async function createEvent(data: EventInput) {
   }
 }
 export async function checkSlugAvailability(slug: string) {
+  const session = await getSession();
+  const user = await getUserContext(session?.id);
+  if (!user || !(await can(user, "create", "event", null))) {
+    return { available: true };
+  }
   const existingEvent = await db.query.events.findFirst({
     where: eq(events.slug, slug),
   });

app/actions/feed.ts

@@ -83,6 +83,10 @@ export async function getSeriesFeed(seriesId: string, limit = 50, offset = 0) {
     if (!seriesData) {
       return { success: false, error: "Series not found" };
     }
+    if (!(await can(user, "view", "series", seriesData))) {
+      if (!user) return { success: false, error: "Unauthorized" };
+      return { success: false, error: "Forbidden" };
+    }
     const accessibleEventIdsSet = await getAccessibleEventIds(
       user?.id,
       seriesData.events,

app/actions/map.ts

@@ -4,6 +4,7 @@ import { getSession } from "@/lib/auth";
 import { db } from "@/lib/db";
 import { events, media } from "@/lib/db/schema";
 import { logger } from "@/lib/logger";
+import { getMediaProxyUrl } from "@/lib/media/s3";
 import { getAccessibleEventIds, getUserContext } from "@/lib/policy";
 export async function getMapData(eventSlug?: string | null) {
   try {
@@ -23,8 +24,6 @@ export async function getMapData(eventSlug?: string | null) {
         id: media.id,
         filename: media.filename,
         mimeType: media.mimeType,
-        thumbnailS3Key: media.thumbnailS3Key,
-        s3Key: media.s3Key,
         latitude: media.latitude,
         longitude: media.longitude,
         uploadedAt: media.uploadedAt,
@@ -77,8 +76,7 @@ export async function getMapData(eventSlug?: string | null) {
             id: item.id,
             filename: item.filename,
             mimeType: item.mimeType,
-            thumbnailS3Key: item.thumbnailS3Key,
-            s3Key: item.s3Key,
+            thumbnailUrl: getMediaProxyUrl(item.id, "thumbnail"),
             lat: lat,
             lng: lng,
             uploadedAt: item.uploadedAt,
@@ -130,8 +128,7 @@ export async function getMapData(eventSlug?: string | null) {
             id: media.id,
             filename: media.filename,
             mimeType: media.mimeType,
-            thumbnailS3Key: media.thumbnailS3Key,
-            s3Key: media.s3Key,
+            thumbnailUrl: sql<string>`'/media/' || ${media.id} || '/thumbnail'`,
             uploadedAt: media.uploadedAt,
           })
           .from(media)

app/actions/media.ts

@@ -20,6 +20,8 @@ import { extractVideoMetadata } from "@/lib/media/video-metadata";
 import { can, getUserContext } from "@/lib/policy";
 import { publicMedia } from "@/lib/public-data";
 import { checkStorageLimit } from "@/lib/storage";
+
+const MAX_DIRECT_ACTION_UPLOAD_BYTES = 100 * 1024 * 1024;
 export async function uploadBanner(
   entityType: "event" | "series",
   entityId: string,
@@ -291,6 +293,13 @@ export async function uploadMedia(formData: FormData) {
     if (!validation.valid) {
       return { success: false, error: validation.error };
     }
+    if (file.size > MAX_DIRECT_ACTION_UPLOAD_BYTES) {
+      return {
+        success: false,
+        error:
+          "Direct uploads are limited to 100MB. Use the normal uploader for larger files.",
+      };
+    }
     const event = await db.query.events.findFirst({
       where: eq(events.id, eventId),
     });

app/actions/reports.ts

@@ -4,7 +4,7 @@ import { revalidatePath } from "next/cache";
 import { auditLog } from "@/lib/audit";
 import { getSession } from "@/lib/auth";
 import { db } from "@/lib/db";
-import { reports } from "@/lib/db/schema";
+import { media, reports } from "@/lib/db/schema";
 import { logger } from "@/lib/logger";
 import { can, getUserContext } from "@/lib/policy";
 export async function createReport(mediaId: string, reason: string) {
@@ -16,7 +16,20 @@ export async function createReport(mediaId: string, reason: string) {
   if (!reason.trim()) {
     return { success: false, error: "Reason is required" };
   }
+  if (reason.length > 2000) {
+    return { success: false, error: "Reason is too long" };
+  }
   try {
+    const mediaItem = await db.query.media.findFirst({
+      where: eq(media.id, mediaId),
+      with: { event: true },
+    });
+    if (!mediaItem) {
+      return { success: false, error: "Media not found" };
+    }
+    if (!(await can(user, "view", "media", mediaItem))) {
+      return { success: false, error: "Forbidden" };
+    }
     const [newReport] = await db
       .insert(reports)
       .values({

app/actions/search.ts

@@ -12,6 +12,7 @@ import {
   users,
 } from "@/lib/db/schema";
 import { logger } from "@/lib/logger";
+import { getMediaProxyUrl } from "@/lib/media/s3";
 import {
   augmentMediaWithPermissions,
   can,
@@ -20,6 +21,28 @@ import {
 } from "@/lib/policy";
 import { type PublicUser, toPublicUser } from "@/lib/user-display";
 
+function toSafeMedia(item: any) {
+  const {
+    s3Key: _s3Key,
+    s3Url: _s3Url,
+    thumbnailS3Key: _thumbnailS3Key,
+    originalS3Key: _originalS3Key,
+    originalThumbnailS3Key: _originalThumbnailS3Key,
+    blurredS3Key: _blurredS3Key,
+    blurredThumbnailS3Key: _blurredThumbnailS3Key,
+    exifData: _exifData,
+    latitude: _latitude,
+    longitude: _longitude,
+    ...safe
+  } = item;
+  return {
+    ...safe,
+    url: getMediaProxyUrl(item.id),
+    thumbnailUrl: getMediaProxyUrl(item.id, "thumbnail"),
+    uploadedBy: item.uploadedBy ? toPublicUser(item.uploadedBy) : undefined,
+  };
+}
+
 type PublicUserRow = {
   id: string;
   handle: string | null;
@@ -201,10 +224,7 @@ export async function globalSearch(query: string): Promise<{
         users: userResults.map(toPublicUser),
         events: eventResults,
         series: seriesResults,
-        media: finalMedia.map((item) => ({
-          ...item,
-          uploadedBy: toPublicUser(item.uploadedBy),
-        })),
+        media: finalMedia.map(toSafeMedia),
         tags: tagResults,
       },
     };
@@ -488,10 +508,7 @@ export async function advancedSearch(
         users: userResults.map(toPublicUser),
         events: eventResults,
         series: [],
-        media: finalMedia.map((item) => ({
-          ...item,
-          uploadedBy: toPublicUser(item.uploadedBy),
-        })),
+        media: finalMedia.map(toSafeMedia),
         tags: tagResults,
       },
     };

app/actions/sharing.ts

@@ -30,6 +30,9 @@ export async function createShareLink(
     if (!(await can(user, "create", "share_link", mediaItem))) {
       return { success: false, error: "Unauthorized" };
     }
+    if (mediaItem.blurStatus === "pending") {
+      return { success: false, error: "Media is under review" };
+    }
     const existingLink = await db.query.shareLinks.findFirst({
       where: and(
         eq(shareLinks.mediaId, mediaId),
@@ -124,6 +127,9 @@ export async function getSharedMedia(token: string) {
         error: "Public sharing is disabled for this event",
       };
     }
+    if (link.media.blurStatus === "pending") {
+      return { success: false, error: "Media is under review" };
+    }
     db.update(shareLinks)
       .set({ views: link.views + 1 })
       .where(eq(shareLinks.token, token))