From 845182047d33a90e4fde30b7167a89d5a4a15e04 Mon Sep 17 00:00:00 2001 From: Xenon010101 Date: Sat, 30 May 2026 10:05:06 +0530 Subject: [PATCH 1/3] Fix: POST /send-email route missing authentication Closes #129 Added verifyToken middleware to /send-email endpoint so that emergency SOS emails can only be sent by authenticated users. Previously anyone could POST to /send-email and trigger emergency alerts to contacts, enabling spam and alert fatigue attacks. Signed-off-by: Xenon010101 --- backend/routes/email.js | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/backend/routes/email.js b/backend/routes/email.js index 672ba04..775aec4 100644 --- a/backend/routes/email.js +++ b/backend/routes/email.js @@ -1,10 +1,11 @@ const express = require('express'); const { DEFAULT_RECIPIENTS, sendEmergencyEmail } = require('../services/emailService'); const logger = require('../utils/logger'); +const { verifyToken } = require('../middleware/auth'); const router = express.Router(); -router.post('/', async (req, res) => { +router.post('/', verifyToken, async (req, res) => { try { const report = req?.body?.report; const recipients = Array.isArray(req?.body?.recipients) ? req.body.recipients : DEFAULT_RECIPIENTS; From 965950b452199ddb074df0420b9dd8db8d524529 Mon Sep 17 00:00:00 2001 From: Xenon010101 Date: Sat, 30 May 2026 10:05:15 +0530 Subject: [PATCH 2/3] Fix: Reduce body limit from 8mb to 1mb and remove duplicate route mounting Closes #70, Closes #126 - Reduced express.json body limit from 8mb to 1mb (8mb was excessive for most endpoints and increased abuse potential) - Removed duplicate app.use(userVideoRoutes) which caused redundant middleware execution and potential double-prefixing issues Signed-off-by: Xenon010101 --- backend/server.js | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/backend/server.js b/backend/server.js index ad7ed78..eba3bdd 100644 --- a/backend/server.js +++ b/backend/server.js @@ -16,7 +16,7 @@ const app = express(); const PORT = process.env.PORT || 5000; app.use(cors()); -app.use(express.json({ limit: '8mb' })); +app.use(express.json({ limit: '1mb' })); app.use((req, res, next) => { const startedAt = Date.now(); @@ -49,7 +49,6 @@ app.use('/api/history', historyRoutes); app.use('/api/vehicle-observations', vehicleObservationRoutes); app.use('/api/incidents', incidentRoutes); app.use('/api/audio', audioRoutes); -app.use(userVideoRoutes); app.use('/api', userVideoRoutes); // Supports both: From b04bde91f856dc041a641df33ba15516c8eb8ada Mon Sep 17 00:00:00 2001 From: Xenon010101 Date: Sat, 30 May 2026 10:07:11 +0530 Subject: [PATCH 3/3] Fix: No input validation on incidentId path parameter Closes #62 Added isValidIncidentId check (non-empty string, max 64 chars) with Express router.param middleware so all /:incidentId routes reject malformed IDs with a clean 400 response instead of processing them. Signed-off-by: Xenon010101 --- backend/routes/incidents.js | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/backend/routes/incidents.js b/backend/routes/incidents.js index e107e09..b877063 100644 --- a/backend/routes/incidents.js +++ b/backend/routes/incidents.js @@ -34,12 +34,23 @@ const writeDb = (db) => { fs.renameSync(tmpPath, DB_PATH); }; +const isValidIncidentId = (id) => + typeof id === 'string' && id.length > 0 && id.length <= 64; + const findIncident = (db, incidentId) => db.incidents.find((i) => i.incidentId === incidentId) || null; // All incident routes require auth router.use(verifyToken); +// Validate incidentId parameter format +router.param('incidentId', (req, res, next, id) => { + if (!isValidIncidentId(id)) { + return res.status(400).json({ success: false, error: 'Invalid incidentId format.' }); + } + next(); +}); + /** * POST /api/incidents/mock * Creates a mocked incident report record for the authenticated user.