From fbf2ff73c22bc8c2499afccb4ee24635eea6b4b3 Mon Sep 17 00:00:00 2001 From: Mauricio Siu Date: Mon, 20 Jul 2026 17:08:32 -0600 Subject: [PATCH] fix(security): stop user-supplied certificatePath in create schema Same drizzle-zod $defaultFn-as-optional leak as schedule appName: certificatePath (notNull + $defaultFn) was overridable, enabling path traversal out of the certs dir even with the escaped shell paths. Omit it from apiCreateCertificate so it is always server-generated (completes GHSA-q9qw). --- packages/server/src/db/schema/certificate.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/server/src/db/schema/certificate.ts b/packages/server/src/db/schema/certificate.ts index bf1da2296..ad96a3fa1 100644 --- a/packages/server/src/db/schema/certificate.ts +++ b/packages/server/src/db/schema/certificate.ts @@ -45,7 +45,7 @@ export const apiCreateCertificate = createInsertSchema(certificates, { privateKey: z.string().min(1), autoRenew: z.boolean().optional(), serverId: z.string().optional(), -}); +}).omit({ certificatePath: true }); export const apiFindCertificate = z.object({ certificateId: z.string().min(1),