lockbitchat
42be55aaeb
- Remove send-path keyword blocklist that silently rejected legitimate messages (e.g. "constructor", "global", "document.", literal "javascript:") without adding protection. XSS is enforced at the rendering boundary by the receive-side DOMPurify pass and by sanitizeMessage() before encryption. - Preserve newlines/tabs/indentation in _sanitizeInputString; stop collapsing all whitespace which destroyed multi-line messages and code snippets. - Stop logging raw AAD (sessionId + keyFingerprint) on validation failure; log length only, in both message and file-message AAD validators. - Add Strict-Transport-Security (2y + preload) and Permissions-Policy (camera=self for QR, rest denied) to nginx.conf and .htaccess. - Add tests/outgoing-message-integrity.test.mjs regression suite.
41 lines
2.1 KiB
JSON
41 lines
2.1 KiB
JSON
{
|
|
"name": "securebit-chat",
|
|
"version": "4.8.12",
|
|
"description": "Secure P2P Communication Application with End-to-End Encryption",
|
|
"main": "index.html",
|
|
"scripts": {
|
|
"build": "npm run build:css && npm run build:js && npm run post-build",
|
|
"build:css": "npx tailwindcss -i src/styles/tw-input.css -o assets/tailwind.css --minify --content \"./index.html,./src/**/*.jsx,./src/**/*.js\"",
|
|
"build:js": "npx esbuild src/app.jsx --bundle --format=esm --outfile=dist/app.js --sourcemap && npx esbuild src/scripts/app-boot.js --bundle --format=esm --outfile=dist/app-boot.js --sourcemap && npx esbuild src/scripts/qr-local.js --bundle --format=esm --outfile=dist/qr-local.js --sourcemap",
|
|
"post-build": "node scripts/post-build.js",
|
|
"dev": "npm run build && python -m http.server 8000",
|
|
"watch": "npx tailwindcss -i src/styles/tw-input.css -o assets/tailwind.css --watch",
|
|
"serve": "npx http-server -p 8000",
|
|
"test": "node tests/sas-verification.test.mjs && node tests/file-transfer-consent.test.mjs && node tests/incoming-message-sanitization.test.mjs && node tests/outgoing-message-integrity.test.mjs && node tests/file-type-allowlist.test.mjs && node tests/webrtc-privacy-mode.test.mjs && node tests/indexeddb-metadata-encryption.test.mjs && node tests/disconnect-cleanup.test.mjs && node tests/timer-lifecycle.test.mjs && node tests/file-transfer-cleanup.test.mjs && node tests/file-transfer-ui-cleanup.test.mjs && node tests/file-transfer-callback-propagation.test.mjs && node tests/debug-window-hooks.test.mjs && node tests/inbound-message-rate-limit.test.mjs && node tests/file-transfer-chunk-rate-limit.test.mjs && node tests/ice-servers-validation.test.mjs"
|
|
},
|
|
"keywords": [
|
|
"p2p",
|
|
"chat",
|
|
"encryption",
|
|
"webrtc",
|
|
"privacy",
|
|
"security"
|
|
],
|
|
"author": "SecureBit Team",
|
|
"license": "MIT",
|
|
"devDependencies": {
|
|
"esbuild": "^0.28.1",
|
|
"jsdom": "^28.1.0",
|
|
"tailwindcss": "3.4.17"
|
|
},
|
|
"dependencies": {
|
|
"base64-js": "1.5.1",
|
|
"cbor-js": "0.1.0",
|
|
"dompurify": "^3.4.4",
|
|
"html5-qrcode": "2.3.8",
|
|
"pako": "2.1.0",
|
|
"qr-scanner": "1.4.2",
|
|
"qrcode": "1.5.4"
|
|
}
|
|
}
|