@carrierllc/mcp 0.2.18 → 0.2.19

package/templates/storefront/package.json

@@ -17,7 +17,7 @@
     "clsx": "^2.1.1",
     "framer-motion": "^11.15.0",
     "geist": "^1.3.1",
-    "next": "^15.3.0",
+    "next": "^16.3.0",
     "react": "^19.0.0",
     "react-dom": "^19.0.0",
     "tailwind-merge": "^2.6.0"
@@ -29,8 +29,8 @@
     "@types/node": "^22.0.0",
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.0.0",
-    "eslint": "^9.0.0",
-    "eslint-config-next": "^15.3.0",
+    "eslint": "^10.8.1",
+    "eslint-config-next": "^16.3.0",
     "tailwindcss": "^4.1.4",
     "typescript": "^5.8.0",
     "wrangler": "^4.94.0"

package/templates/storefront/src/lib/checkout-order-claim.ts

@@ -7,11 +7,23 @@ type StripeSession = {
   customer_details?: { email?: string | null };
 };
 
+/** See verify-checkout-session.ts — same charset gate for path interpolation. */
+const STRIPE_SESSION_ID_RE = /^[A-Za-z0-9_-]{1,256}$/;
+
+function safeStripeSessionId(sessionId: string): string | null {
+  if (typeof sessionId !== "string" || !STRIPE_SESSION_ID_RE.test(sessionId)) {
+    return null;
+  }
+  return encodeURIComponent(sessionId);
+}
+
 async function fetchStripeSession(sessionId: string): Promise<StripeSession | null> {
   const stripeKey = process.env.STRIPE_SECRET_KEY;
   if (!stripeKey) return null;
+  const safeSessionId = safeStripeSessionId(sessionId);
+  if (!safeSessionId) return null;
 
-  const resp = await fetch(`https://api.stripe.com/v1/checkout/sessions/${sessionId}`, {
+  const resp = await fetch(`https://api.stripe.com/v1/checkout/sessions/${safeSessionId}`, {
     headers: { Authorization: `Bearer ${stripeKey}` },
   });
   if (!resp.ok) return null;
@@ -21,12 +33,14 @@ async function fetchStripeSession(sessionId: string): Promise<StripeSession | nu
 async function setStripeClaimedBy(sessionId: string, userId: string): Promise<boolean> {
   const stripeKey = process.env.STRIPE_SECRET_KEY;
   if (!stripeKey) return false;
+  const safeSessionId = safeStripeSessionId(sessionId);
+  if (!safeSessionId) return false;
 
   const formBody = new URLSearchParams({
     "metadata[claimedByUserId]": userId,
   });
 
-  const resp = await fetch(`https://api.stripe.com/v1/checkout/sessions/${sessionId}`, {
+  const resp = await fetch(`https://api.stripe.com/v1/checkout/sessions/${safeSessionId}`, {
     method: "POST",
     headers: {
       Authorization: `Bearer ${stripeKey}`,

package/templates/storefront/src/lib/verify-checkout-session.ts

@@ -12,6 +12,22 @@ type VerifyResult =
   | { ok: true; orderId: string; purchaserEmail: string | null }
   | { ok: false };
 
+/**
+ * Stripe Checkout session ids are opaque tokens (`cs_test_…` / `cs_live_…`).
+ * They are interpolated into the Stripe API URL, so an unvalidated value can
+ * inject `?`/`#`/`../` and retarget the request *with the Stripe secret key
+ * attached* (CodeQL js/request-forgery). Restrict to an explicit charset and
+ * encode before interpolation.
+ */
+const STRIPE_SESSION_ID_RE = /^[A-Za-z0-9_-]{1,256}$/;
+
+function safeStripeSessionId(sessionId: string): string | null {
+  if (typeof sessionId !== "string" || !STRIPE_SESSION_ID_RE.test(sessionId)) {
+    return null;
+  }
+  return encodeURIComponent(sessionId);
+}
+
 /**
  * Confirms a Stripe Checkout session is paid before allowing post-payment flows.
  * Mock sessions are only accepted when Stripe is not configured (local/dev builds).
@@ -27,7 +43,8 @@ export async function verifyCheckoutSession(
     return { ok: true, orderId: templateId, purchaserEmail: null };
   }
 
-  if (!sessionId) {
+  const safeSessionId = safeStripeSessionId(sessionId);
+  if (!safeSessionId) {
     return { ok: false };
   }
 
@@ -36,7 +53,7 @@ export async function verifyCheckoutSession(
     return { ok: false };
   }
 
-  const resp = await fetch(`https://api.stripe.com/v1/checkout/sessions/${sessionId}`, {
+  const resp = await fetch(`https://api.stripe.com/v1/checkout/sessions/${safeSessionId}`, {
     headers: { Authorization: `Bearer ${stripeKey}` },
   });