5d0b4837d8
- C1: Replace all ClickHouse string interpolation with parameterized queries (query_params) to eliminate SQL injection in analytics endpoints - C3: Strip Caddy placeholder patterns from redirect rules, protected paths, and Authentik auth endpoint to prevent config injection - C4: Replace WAF custom directive blocklist with allowlist approach — only SecRule/SecAction/SecMarker/SecDefaultAction permitted; block ctl:ruleEngine and Include directives - H2: Validate GCM authentication tag is exactly 16 bytes before decryption - H3: Validate forward auth redirect URIs (scheme, no credentials) to prevent open redirects - H4: Switch 11 analytics/WAF/geoip endpoints from session-only requireAdmin to requireApiAdmin supporting both Bearer token and session auth - H5: Add input validation for instance-mode (whitelist) and sync-token (32-char minimum) in settings API - M1: Add non-root user to l4-port-manager Dockerfile - M5: Document Caddy admin API binding security rationale - Document C2 (custom config injection) and H1 (SSRF via upstreams) as intentional admin features Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
24 lines
904 B
TypeScript
24 lines
904 B
TypeScript
import { NextRequest, NextResponse } from "next/server";
|
|
import { requireApiAdmin, apiErrorResponse } from "@/src/lib/api-auth";
|
|
import { listWafEvents, countWafEvents } from "@/src/lib/models/waf-events";
|
|
|
|
export async function GET(request: NextRequest) {
|
|
try {
|
|
await requireApiAdmin(request);
|
|
const { searchParams } = request.nextUrl;
|
|
const page = Math.max(1, parseInt(searchParams.get("page") ?? "1", 10) || 1);
|
|
const perPage = Math.min(200, Math.max(1, parseInt(searchParams.get("per_page") ?? "50", 10) || 50));
|
|
const search = searchParams.get("search")?.trim() || undefined;
|
|
const offset = (page - 1) * perPage;
|
|
|
|
const [events, total] = await Promise.all([
|
|
listWafEvents(perPage, offset, search),
|
|
countWafEvents(search),
|
|
]);
|
|
|
|
return NextResponse.json({ events, total, page, perPage });
|
|
} catch (error) {
|
|
return apiErrorResponse(error);
|
|
}
|
|
}
|