Fix timing leak, CORS enforcement, CI race condition, and frontend hardcoding

.github/workflows/update-live-feed.yml

@@ -171,20 +171,13 @@ jobs:
           echo 'Initial push failed (likely non-fast-forward). Rebasing and retrying once.'
           git fetch origin main
           if git pull --rebase origin main; then
-            git push
+            git push --force-with-lease
             exit 0
           fi
-          echo 'Rebase conflict detected in generated artifacts; resolving in favor of newly generated files.'
-          git checkout --theirs live-alerts.json || true
-          git checkout --theirs data/quarantined-sources.json || true
-          git checkout --theirs source-quarantine.html || true
-          git checkout --theirs data/source-remediation-sweep.json || true
-          git checkout --theirs data/top-20-source-remediation.json || true
-          git checkout --theirs data/brialert.sqlite || true
-          git add live-alerts.json data/quarantined-sources.json source-quarantine.html \
-            data/source-remediation-sweep.json data/top-20-source-remediation.json data/brialert.sqlite || true
-          git rebase --continue
-          git push
+          echo 'Rebase conflict on generated artifacts — aborting rebase and using merge strategy.'
+          git rebase --abort
+          git merge origin/main -X ours --no-edit
+          git push --force-with-lease
 
   verify-live-feed-freshness:
     needs: commit-live-feed

.gitignore

@@ -2,5 +2,6 @@ node_modules/
 .debug-artifacts/
 .DS_Store
 Thumbs.db
+data/*.sqlite
 data/*.sqlite-wal
 data/*.sqlite-shm

404.html

@@ -5,16 +5,7 @@
   <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover">
   <title>Brialert redirect</title>
   <meta http-equiv="refresh" content="0; url=/index.html">
-  <script>
-    const canonicalTarget = location.pathname.toLowerCase().includes('/brialert')
-      ? '/Brialert/index.html'
-      : '/index.html';
-    const query = location.search || '';
-    const hash = location.hash || '';
-    if (location.pathname.toLowerCase() !== canonicalTarget.toLowerCase()) {
-      location.replace(canonicalTarget + query + hash);
-    }
-  </script>
+  <script src="app/redirect.js"></script>
   <style>
     body {
       margin: 0;

api/_lib/admin-session.js

@@ -95,8 +95,12 @@ function verifySignedToken(rawToken) {
   const expectedSignature = signToken(encodedPayload);
   const expectedBuffer = Buffer.from(expectedSignature);
   const receivedBuffer = Buffer.from(encodedSignature);
-  if (expectedBuffer.length !== receivedBuffer.length) return null;
-  if (!crypto.timingSafeEqual(expectedBuffer, receivedBuffer)) return null;
+  const maxLen = Math.max(expectedBuffer.length, receivedBuffer.length);
+  const paddedExpected = Buffer.alloc(maxLen);
+  const paddedReceived = Buffer.alloc(maxLen);
+  expectedBuffer.copy(paddedExpected);
+  receivedBuffer.copy(paddedReceived);
+  if (!crypto.timingSafeEqual(paddedExpected, paddedReceived) || expectedBuffer.length !== receivedBuffer.length) return null;
   try {
     const payload = JSON.parse(base64UrlDecode(encodedPayload));
     if (!payload || typeof payload !== 'object') return null;
@@ -146,17 +150,15 @@ function serializeCookie(parts, value, maxAgeSeconds) {
 export function applyCorsHeaders(request, response, methods) {
   const requestOrigin = normaliseOrigin(request?.headers?.origin);
   const allowedOrigins = new Set(getAllowedOrigins());
-  if (requestOrigin && allowedOrigins.has(requestOrigin)) {
+  const originAllowed = !requestOrigin || allowedOrigins.has(requestOrigin);
+  if (requestOrigin && originAllowed) {
     response.setHeader('Access-Control-Allow-Origin', requestOrigin);
     response.setHeader('Access-Control-Allow-Credentials', 'true');
     response.setHeader('Vary', 'Origin');
   }
   response.setHeader('Access-Control-Allow-Methods', methods);
   response.setHeader('Access-Control-Allow-Headers', 'Content-Type');
-  if (request?.method === 'OPTIONS') {
-    return !requestOrigin || allowedOrigins.has(requestOrigin);
-  }
-  return true;
+  return originAllowed;
 }
 
 export function readAdminSession(request) {

api/_lib/github-persistence.js

@@ -66,18 +66,62 @@ function encodeBase64(plainText) {
   return Buffer.from(plainText, 'utf8').toString('base64');
 }
 
-function parseJsonFile(raw, filePath) {
+function parseJsonFile(raw) {
   try {
     return JSON.parse(raw);
-  } catch (error) {
+  } catch {
     throw new ApiError(
       'persistence-failure',
-      `Invalid JSON in ${filePath}: ${error instanceof Error ? error.message : String(error)}`,
+      'Repository data file contains invalid JSON.',
       500
     );
   }
 }
 
+/**
+ * Returns true when a hostname looks like a private, loopback, link-local, or
+ * otherwise non-routable address that must be rejected to prevent SSRF.
+ * Checks the raw hostname string — no DNS resolution is performed, so only
+ * literal IP addresses and well-known internal hostnames are caught.
+ */
+function isPrivateOrReservedHost(hostname) {
+  const host = String(hostname || '').toLowerCase();
+  if (!host) return true;
+
+  // Loopback / localhost
+  if (host === 'localhost' || host === '[::1]') return true;
+
+  // Strip IPv6 brackets for numeric checks
+  const bare = host.startsWith('[') && host.endsWith(']') ? host.slice(1, -1) : host;
+
+  // IPv6 loopback & link-local
+  if (bare === '::1' || bare.startsWith('fe80:') || bare.startsWith('fc00:') || bare.startsWith('fd00:')) return true;
+
+  // IPv4 dotted-quad checks
+  const ipv4Parts = bare.split('.');
+  if (ipv4Parts.length === 4 && ipv4Parts.every((p) => /^\d{1,3}$/.test(p))) {
+    const octets = ipv4Parts.map(Number);
+    if (octets.some((o) => o > 255)) return true;             // malformed — block as suspicious
+    const [a, b] = octets;
+    if (a === 127) return true;                              // 127.0.0.0/8   loopback
+    if (a === 10) return true;                               // 10.0.0.0/8    private
+    if (a === 172 && b >= 16 && b <= 31) return true;        // 172.16.0.0/12 private
+    if (a === 192 && b === 168) return true;                 // 192.168.0.0/16 private
+    if (a === 169 && b === 254) return true;                 // 169.254.0.0/16 link-local
+    if (a === 0) return true;                                // 0.0.0.0/8
+    if (a === 100 && b >= 64 && b <= 127) return true;      // 100.64.0.0/10 CGN shared
+    if (a === 198 && (b === 18 || b === 19)) return true;    // 198.18.0.0/15 benchmarking
+    if (a >= 224) return true;                               // 224+  multicast / reserved
+  }
+
+  // Block common internal / metadata hostnames
+  if (host.endsWith('.local') || host.endsWith('.internal') || host.endsWith('.localhost')) return true;
+  // Cloud provider metadata endpoints
+  if (host === '169.254.169.254' || host === 'metadata.google.internal') return true;
+
+  return false;
+}
+
 export function validateAbsoluteHttpUrl(value, code = 'invalid-url') {
   const trimmed = String(value || '').trim();
   if (!trimmed) {
@@ -92,6 +136,9 @@ export function validateAbsoluteHttpUrl(value, code = 'invalid-url') {
   if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
     throw new ApiError(code, 'Replacement URL must use http or https.', 400);
   }
+  if (isPrivateOrReservedHost(parsed.hostname)) {
+    throw new ApiError(code, 'URL must not point to a private or internal network address.', 400);
+  }
   return parsed.toString();
 }
 
@@ -120,7 +167,7 @@ export async function loadJsonFile(pathName) {
     config,
     path: pathName,
     sha: payload.sha,
-    data: parseJsonFile(content, pathName)
+    data: parseJsonFile(content)
   };
 }
 

api/approve-source.js

@@ -156,7 +156,9 @@ async function resolveShardPath(config, approvedSource, shardPaths) {
 }
 
 export default async function handler(request, response) {
-  applyCorsHeaders(request, response, 'POST,OPTIONS');
+  if (!applyCorsHeaders(request, response, 'POST,OPTIONS')) {
+    return response.status(403).json({ ok: false, error: 'origin-not-allowed', detail: 'Cross-origin request from disallowed origin.' });
+  }
   if (request.method === 'OPTIONS') {
     response.setHeader('Allow', 'POST,OPTIONS');
     return response.status(204).end();
@@ -251,8 +253,8 @@ export default async function handler(request, response) {
       try {
         await dispatchWorkflow(requestsFile.config, FEED_WORKFLOW_FILENAME);
         workflowTriggered = true;
-      } catch (error) {
-        workflowMessage = error instanceof Error ? error.message : String(error);
+      } catch {
+        workflowMessage = 'Feed refresh workflow could not be triggered.';
       }
     }
 

api/auth/logout.js

@@ -4,7 +4,9 @@ import {
 } from '../_lib/admin-session.js';
 
 export default async function handler(request, response) {
-  applyCorsHeaders(request, response, 'POST,OPTIONS');
+  if (!applyCorsHeaders(request, response, 'POST,OPTIONS')) {
+    return response.status(403).json({ ok: false, error: 'origin-not-allowed', detail: 'Cross-origin request from disallowed origin.' });
+  }
   if (request.method === 'OPTIONS') {
     return response.status(204).end();
   }

api/auth/session.js

@@ -19,7 +19,9 @@ function startLoginUrlFor(originHint) {
 }
 
 export default async function handler(request, response) {
-  applyCorsHeaders(request, response, 'GET,OPTIONS');
+  if (!applyCorsHeaders(request, response, 'GET,OPTIONS')) {
+    return response.status(403).json({ ok: false, error: 'origin-not-allowed', detail: 'Cross-origin request from disallowed origin.' });
+  }
   if (request.method === 'OPTIONS') {
     return response.status(204).end();
   }

api/quarantined-sources.js

@@ -61,7 +61,9 @@ function sanitiseRequests(rawRequests) {
 }
 
 export default async function handler(request, response) {
-  applyCorsHeaders(request, response, 'GET,OPTIONS');
+  if (!applyCorsHeaders(request, response, 'GET,OPTIONS')) {
+    return response.status(403).json({ ok: false, error: 'origin-not-allowed', detail: 'Cross-origin request from disallowed origin.' });
+  }
   if (request.method === 'OPTIONS') {
     response.setHeader('Allow', 'GET,OPTIONS');
     return response.status(204).end();

api/request-source.js

@@ -235,7 +235,9 @@ function sortNewestFirst(items) {
 }
 
 export default async function handler(request, response) {
-  applyCorsHeaders(request, response, 'GET,POST,OPTIONS');
+  if (!applyCorsHeaders(request, response, 'GET,POST,OPTIONS')) {
+    return response.status(403).json({ ok: false, error: 'origin-not-allowed', detail: 'Cross-origin request from disallowed origin.' });
+  }
   if (request.method === 'OPTIONS') {
     response.setHeader('Allow', 'GET,POST,OPTIONS');
     return response.status(204).end();

api/restore-source.js

@@ -160,7 +160,9 @@ async function resolveShardPath(config, restoredSource, shardPaths) {
 }
 
 export default async function handler(request, response) {
-  applyCorsHeaders(request, response, 'POST,OPTIONS');
+  if (!applyCorsHeaders(request, response, 'POST,OPTIONS')) {
+    return response.status(403).json({ ok: false, error: 'origin-not-allowed', detail: 'Cross-origin request from disallowed origin.' });
+  }
   if (request.method === 'OPTIONS') {
     response.setHeader('Allow', 'POST,OPTIONS');
     return response.status(204).end();
@@ -274,8 +276,8 @@ export default async function handler(request, response) {
       try {
         await dispatchWorkflow(quarantinedFile.config, FEED_WORKFLOW_FILENAME);
         workflowTriggered = true;
-      } catch (error) {
-        workflowMessage = error instanceof Error ? error.message : String(error);
+      } catch {
+        workflowMessage = 'Feed refresh workflow could not be triggered.';
       }
     }
 

api/trigger-live-feed.js

@@ -34,7 +34,9 @@ function sendError(response, error) {
 }
 
 export default async function handler(request, response) {
-  applyCorsHeaders(request, response, 'POST,OPTIONS');
+  if (!applyCorsHeaders(request, response, 'POST,OPTIONS')) {
+    return response.status(403).json({ ok: false, error: 'origin-not-allowed', detail: 'Cross-origin request from disallowed origin.' });
+  }
   if (request.method === 'OPTIONS') {
     response.setHeader('Allow', 'POST,OPTIONS');
     return response.status(204).end();
@@ -60,6 +62,11 @@ export default async function handler(request, response) {
       });
     }
 
+    // Claim the slot before the async dispatch so concurrent requests see
+    // the lock immediately (avoids check-then-act race).
+    const previousTriggerTime = lastTriggerTime;
+    lastTriggerTime = now;
+
     const config = getRepoConfig();
 
     const dispatchUrl = `${GITHUB_API_BASE}/repos/${config.owner}/${config.repo}/actions/workflows/${WORKFLOW_FILENAME}/dispatches`;
@@ -79,26 +86,19 @@ export default async function handler(request, response) {
     });
 
     if (!dispatchResponse.ok) {
-      const errorText = await dispatchResponse.text().catch(() => '');
+      // Roll back so the next request can retry after a real failure.
+      lastTriggerTime = previousTriggerTime;
       let errorMessage = 'Failed to trigger workflow dispatch.';
-      try {
-        const errorPayload = JSON.parse(errorText);
-        errorMessage = errorPayload.message || errorMessage;
-      } catch {
-        // Use default error message
-      }
 
       if (dispatchResponse.status === 401 || dispatchResponse.status === 403) {
-        throw new ApiError('unauthorized', errorMessage, 503);
+        throw new ApiError('unauthorized', 'GitHub API authentication failed.', 503);
       }
       if (dispatchResponse.status === 404) {
-        throw new ApiError('workflow-not-found', `Workflow ${WORKFLOW_FILENAME} not found.`, 404);
+        throw new ApiError('workflow-not-found', 'Workflow not found.', 404);
       }
       throw new ApiError('trigger-failed', errorMessage, 500);
     }
 
-    lastTriggerTime = now;
-
     return response.status(200).json({
       ok: true,
       detail: 'Live feed workflow triggered successfully. New feed data should appear within 2-5 minutes.',

app/boot/index.mjs

@@ -14,7 +14,6 @@ import {
 import { MAP_VIEW_MODES } from '../../shared/ui-constants.mjs';
 import { createModalRuntime } from '../render/modal.mjs';
 import {
-  BRIEFING_MODE_STORAGE_KEY,
   GEO_LOOKUP_URL,
   MAP_INIT_FALLBACK_DELAY_MS,
   MAP_INIT_IDLE_TIMEOUT_MS,

app/feed/index.mjs

@@ -4,6 +4,7 @@ import {
   loadWatchGeography
 } from '../../shared/feed-controller.mjs';
 import { reportBackgroundError } from '../../shared/logger.mjs';
+import { DEFAULT_API_BASE } from '../../shared/api-base.mjs';
 
 const MANUAL_REFRESH_POLL_INTERVAL_MS = 5_000;
 const MANUAL_REFRESH_MAX_WAIT_MS = 90_000;
@@ -15,7 +16,7 @@ function currentOriginBase() {
 }
 
 const LIVE_FEED_TRIGGER_API_BASES = [
-  'https://brialertbackend.vercel.app',
+  DEFAULT_API_BASE,
   currentOriginBase()
 ].filter(Boolean);
 const LIVE_FEED_TRIGGER_API_PATHS = [