lobstakit-cloud 1.0.4 → 1.0.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lobstakit-cloud",
-  "version": "1.0.4",
+  "version": "1.0.5",
   "description": "LobstaKit Cloud — Setup wizard and management for LobstaCloud gateways",
   "main": "server.js",
   "bin": {

package/server.js

@@ -1072,10 +1072,10 @@ app.post('/api/tailscale/connect', (req, res) => {
       return res.status(400).json({ error: 'Auth key is required' });
     }
 
-    // Validate auth key format (tskey-auth-...)
-    if (!authKey.startsWith('tskey-auth-') && !authKey.startsWith('tskey-')) {
+    // Strict validation: Tailscale auth keys are alphanumeric + hyphens only (CRITICAL-1: prevent command injection)
+    if (!/^tskey-auth-[a-zA-Z0-9-]+$/.test(authKey)) {
       return res.status(400).json({
-        error: 'Invalid auth key format. Tailscale auth keys start with tskey-auth-'
+        error: 'Invalid auth key format. Tailscale auth keys start with tskey-auth- and contain only alphanumeric characters and hyphens.'
       });
     }
 
@@ -1102,6 +1102,7 @@ app.post('/api/tailscale/connect', (req, res) => {
 
     // Run tailscale up with the auth key
     try {
+      // SAFE: authKey validated above with /^tskey-auth-[a-zA-Z0-9-]+$/ — no injection possible
       execSync(`tailscale up --authkey=${authKey} --accept-routes --accept-dns`, {
         stdio: 'pipe',
         timeout: 30000