lobstakit-cloud 1.0.4 → 1.0.6

package/lib/config.js

@@ -114,7 +114,7 @@ function writeConfig({ apiKey, model, channel, telegramBotToken, telegramUserId,
     }
   };
 
-  fs.writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2), 'utf8');
+  fs.writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2), { encoding: 'utf8', mode: 0o600 });
   console.log('[config] Config written to', CONFIG_PATH);
   return config;
 }
@@ -126,7 +126,7 @@ function writeRawConfig(configObj) {
   if (!fs.existsSync(CONFIG_DIR)) {
     fs.mkdirSync(CONFIG_DIR, { recursive: true });
   }
-  fs.writeFileSync(CONFIG_PATH, JSON.stringify(configObj, null, 2), 'utf8');
+  fs.writeFileSync(CONFIG_PATH, JSON.stringify(configObj, null, 2), { encoding: 'utf8', mode: 0o600 });
   console.log('[config] Raw config written to', CONFIG_PATH);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lobstakit-cloud",
-  "version": "1.0.4",
+  "version": "1.0.6",
   "description": "LobstaKit Cloud — Setup wizard and management for LobstaCloud gateways",
   "main": "server.js",
   "bin": {

package/server.js

@@ -1072,10 +1072,10 @@ app.post('/api/tailscale/connect', (req, res) => {
       return res.status(400).json({ error: 'Auth key is required' });
     }
 
-    // Validate auth key format (tskey-auth-...)
-    if (!authKey.startsWith('tskey-auth-') && !authKey.startsWith('tskey-')) {
+    // Strict validation: Tailscale auth keys are alphanumeric + hyphens only (CRITICAL-1: prevent command injection)
+    if (!/^tskey-auth-[a-zA-Z0-9-]+$/.test(authKey)) {
       return res.status(400).json({
-        error: 'Invalid auth key format. Tailscale auth keys start with tskey-auth-'
+        error: 'Invalid auth key format. Tailscale auth keys start with tskey-auth- and contain only alphanumeric characters and hyphens.'
       });
     }
 
@@ -1102,6 +1102,7 @@ app.post('/api/tailscale/connect', (req, res) => {
 
     // Run tailscale up with the auth key
     try {
+      // SAFE: authKey validated above with /^tskey-auth-[a-zA-Z0-9-]+$/ — no injection possible
       execSync(`tailscale up --authkey=${authKey} --accept-routes --accept-dns`, {
         stdio: 'pipe',
         timeout: 30000