Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
61 changes: 0 additions & 61 deletions .github/workflows/deploy.yml

This file was deleted.

2 changes: 1 addition & 1 deletion .prettierrc
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
"tabWidth": 4,
"singleQuote": false,
"trailingComma": "all",
"printWidth": 200,
"printWidth": 100,
"plugins": ["prettier-plugin-svelte", "prettier-plugin-tailwindcss"],
"overrides": [
{
Expand Down
7 changes: 6 additions & 1 deletion .vscode/extensions.json
Original file line number Diff line number Diff line change
@@ -1,3 +1,8 @@
{
"recommendations": ["svelte.svelte-vscode", "esbenp.prettier-vscode", "dbaeumer.vscode-eslint", "bradlc.vscode-tailwindcss"]
"recommendations": [
"svelte.svelte-vscode",
"esbenp.prettier-vscode",
"dbaeumer.vscode-eslint",
"bradlc.vscode-tailwindcss"
]
}
4 changes: 3 additions & 1 deletion docs/audit1.md
Original file line number Diff line number Diff line change
Expand Up @@ -113,7 +113,9 @@ AuthnRequest에서 **AssertionConsumerServiceURL을 받아서 바로 사용**.
### 🔥 HTML Injection → XSS (RelayState)

```typescript
const relayStateInput = relayState ? `<input type="hidden" name="RelayState" value="${relayState.replace(/"/g, "&quot;")}">` : "";
const relayStateInput = relayState
? `<input type="hidden" name="RelayState" value="${relayState.replace(/"/g, "&quot;")}">`
: "";
```

`"`만 escape하고 `<`, `>`, `&`는 그대로. `RelayState=abc"><script>alert(1)</script>`로 주면 `"`는 escape되지만, 근데 input value 안이라 ... 확인하자. `value="abc&quot;><script>"` → **quot로 escape 되니까 value는 `abc">...` 문자열이 되긴 함**. 즉 innerHTML이 아니라 value라 실제 script 실행은 안됨. 근데:
Expand Down
5 changes: 4 additions & 1 deletion drizzle.config.ts
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,10 @@ import { defineConfig } from "drizzle-kit";
// db:generate 는 스키마만 읽으므로 자격증명 불필요.
// db:migrate / db:push 실행 시 드리즐이 자체적으로 검증.
const accountId = process.env.CLOUDFLARE_ACCOUNT_ID ?? "";
const databaseId = (process.env.CLOUDFLARE_IS_PREVIEW === "true" ? process.env.CLOUDFLARE_D1_PREVIEW_DATABASE_ID : process.env.CLOUDFLARE_D1_DATABASE_ID) ?? "58033cb8-96f7-46f0-bfc2-057e3f903d3c";
const databaseId =
(process.env.CLOUDFLARE_IS_PREVIEW === "true"
? process.env.CLOUDFLARE_D1_PREVIEW_DATABASE_ID
: process.env.CLOUDFLARE_D1_DATABASE_ID) ?? "58033cb8-96f7-46f0-bfc2-057e3f903d3c";
const token = process.env.CLOUDFLARE_D1_TOKEN ?? process.env.CLOUDFLARE_API_TOKEN ?? "";

export default defineConfig({
Expand Down
Loading
Loading