fix(security): OWASP audit remediation

[Taas-ai]

Summary

Comprehensive OWASP Top 10 security audit and remediation for the Quantum-Shield-NFT platform.

Changes (2 commits)

Commit 1: Launch Readiness Hardening

• NextAuth.js v5 authentication with admin-approved access
• Content Security Policy + HSTS + security headers in vercel.json
• Privacy policy, terms of service, cookie consent
• robots.txt, sitemap.xml, OG meta tags, favicons
• Error boundary component

Commit 2: OWASP Audit Remediation

• Structured Logger (src/lib/logger.ts): Replaces 235+ raw console.log calls with env-aware structured logging (JSON in production, human-readable in dev)
• API Auth Guard (server.js): All state-changing POST endpoints now require API key via preHandler
• Input Validation (server.js): JSON schema validation on all POST routes with additionalProperties: false
• IDOR Prevention (server.js): Transfer endpoint verifies currentOwner matches stored owner before allowing transfer
• CORS Hardening (server.ts): Replaced origin: '*' wildcard with explicit domain whitelist
• IPFS CID Validation (IPFSService.ts): Regex-based CIDv0/CIDv1 format validation + gateway allowlist to prevent SSRF
• X-XSS-Protection Fix (vercel.json): Changed from deprecated 1; mode=block to 0 (CSP replaces this header)
• Logger Migration: GridDBClient, IPFSService, MirrorNodeService, NFTShieldService all migrated to structured logger

OWASP Categories Addressed

Category	Status
A01 Broken Access Control	Fixed (API key auth, IDOR check)
A02 Cryptographic Failures	N/A (ML-DSA-65 + ML-KEM-768)
A03 Injection	Fixed (JSON schema validation)
A04 Insecure Design	Fixed (fail-closed auth)
A05 Security Misconfiguration	Fixed (CORS, headers, error handler)
A06 Vulnerable Components	Assessed (crypto-es transitive, no fix available)
A07 Auth Failures	Fixed (API key guard)
A09 Logging & Monitoring	Fixed (structured logger)
A10 SSRF	Fixed (CID validation, gateway allowlist)

Test plan

• Verify API key auth blocks unauthenticated POST requests
• Verify IDOR check returns 403 when currentOwner doesn't match
• Verify CORS rejects requests from unlisted origins
• Verify IPFS CID validation rejects malformed CIDs
• Verify structured logger outputs JSON in production mode
• Run existing test suite (npm test)

🤖 Generated with Claude Code

In general, to fix log injection for plaintext logs, any user-controlled input that is written into a log line should be sanitized so it cannot break the log structure. For text logs, this typically means removing or normalizing newline and carriage-return characters (and optionally other control characters) from user-controlled strings before interpolating them into log messages.

The best way to fix this here without changing existing semantics is to centralize sanitization inside the logger: ensure that message (and optionally context) are passed through a small helper that strips \r and \n when constructing the human-readable (non-production) log line. The production branch already uses JSON.stringify, which escapes these characters and is not vulnerable in the same way, so we only need to modify the non-production path. We should introduce a private sanitizeLogText function in src/lib/logger.ts and use it when building the string for console.log/console.warn/console.error in the development branch:

• Add a helper like function sanitizeLogText(value: string): string { return value.replace(/[\r\n]/g, ' '); }.
• In formatMessage, in the non-production else block, compute const safeContext = sanitizeLogText(context); const safeMessage = sanitizeLogText(message); and then log `${prefix} [${safeContext}] ${safeMessage}`.
• Keep the data object logged as-is; it is logged as a separate argument and not concatenated into the log line, so it does not affect log structure in the same way.

All required changes are limited to src/lib/logger.ts; no new imports or external dependencies are needed.

---

In general, to fix “state property is written but never read” you either (a) remove the unused state property and any writes to it, or (b) make use of the state property in the component (for example, by rendering it or using it in logic). Here, because the presence of error in State and the setting of it in getDerivedStateFromError suggests the author intended to surface error details, the best fix is to read and render this.state.error in the fallback UI, instead of removing it.

Concretely in web/src/components/error-boundary.tsx:

• Keep the existing State interface and error writes as-is.
• Update the render method’s error branch to:
  • Destructure const { error } = this.state;.
  • Conditionally render extra diagnostic text when error is non-null, e.g. show error.message (and possibly a short generic label) in the fallback content.
• This introduces a read of this.state.error, satisfying CodeQL and preserving the Try Again behavior and error reporting. No new imports or external dependencies are needed; we only add a few JSX nodes using the existing Tailwind-like classNames.

All changes are confined to the render method in this file.

[Taas-ai]

Code Review Complete — All Critical Issues Fixed

Fixes Applied (commit 7e32143)

Severity	Issue	Fix
CRITICAL	API key comparison vulnerable to timing attacks	crypto.timingSafeEqual()
CRITICAL	CSP allowed 'unsafe-eval'	Removed from script-src
HIGH	GET /shield/:id unauthenticated (leaked owner data)	Added requireApiKey
HIGH	Migration/stats endpoints unauthenticated	Added requireApiKey
HIGH	CORS regex matched ANY *.vercel.app subdomain	Restricted to quantum-shield-nft*
HIGH	CID regex had no upper length bound	Added max {58,100}
MEDIUM	Invalid LOG_LEVEL silently suppressed all logs	Added allowlist validation

Review Status

• CodeRabbit AI review: Complete (3 critical, 4 high, 5 medium, 4 low found → 3 critical + 4 high + 1 medium fixed)
• Remaining medium/low items tracked for follow-up

@E-Fdz Ready for your review.

🤖 Generated with Claude Code

[E-Fdz]

/code-rabbit + Human in the loop