By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.
This pull request focuses on improving randomness, validation, and security in the codebase. The main changes include switching to cryptographically secure random number generation for name creation, refining URL validation logic, and ensuring safe encoding of user input in password reset links.
Randomness and security improvements:
Switched from Math.random() to crypto.randomInt() in generateName() within server/db/names.ts, making name generation cryptographically secure. [1][2]
Validation logic:
Updated the domain name regex in isUrlValid() in server/lib/validators.ts to more accurately validate domain names, preventing invalid formats.
User input handling:
Applied encodeURIComponent() to the email parameter in the password reset link in LoginForm.tsx, preventing potential issues with special characters and improving security.
How to test?
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/fosrl/pangolin/pull/1949
**Author:** [@marcschaeferger](https://github.com/marcschaeferger)
**Created:** 11/30/2025
**Status:** ✅ Merged
**Merged:** 12/6/2025
**Merged by:** [@oschwartz10612](https://github.com/oschwartz10612)
**Base:** `main` ← **Head:** `fix-security/other`
---
### 📝 Commits (4)
- [`fbbab60`](https://github.com/fosrl/pangolin/commit/fbbab60956acd77b6c336d8617d77756b220fb50) Potential fix for code scanning alert no. 7: Insecure randomness
- [`3eab3b0`](https://github.com/fosrl/pangolin/commit/3eab3b0827ec159958bae0f0fec2593897ab60eb) Potential fix for code scanning alert no. 8: DOM text reinterpreted as HTML
- [`8df62e8`](https://github.com/fosrl/pangolin/commit/8df62e8b6a2c577343a5c45f057228a2e8ecaae2) Potential fix for code scanning alert no. 19: Inefficient regular expression
- [`336d31c`](https://github.com/fosrl/pangolin/commit/336d31ce39e96cfc21a1e966bb2953d543cf2a8b) fix(validators): restore 2+ char domain label requirement
### 📊 Changes
**3 files changed** (+5 additions, -4 deletions)
<details>
<summary>View changed files</summary>
📝 `server/db/names.ts` (+3 -2)
📝 `server/lib/validators.ts` (+1 -1)
📝 `src/components/LoginForm.tsx` (+1 -1)
</details>
### 📄 Description
## Community Contribution License Agreement
By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.
## Description (generated by Copilot)
See
- https://codeql.github.com/codeql-query-help/javascript/js-insecure-randomness/
- https://codeql.github.com/codeql-query-help/javascript/js-redos/
- https://codeql.github.com/codeql-query-help/javascript/js-xss-through-dom/
**Code generated by Copilot**
This pull request focuses on improving randomness, validation, and security in the codebase. The main changes include switching to cryptographically secure random number generation for name creation, refining URL validation logic, and ensuring safe encoding of user input in password reset links.
**Randomness and security improvements:**
* Switched from `Math.random()` to `crypto.randomInt()` in `generateName()` within `server/db/names.ts`, making name generation cryptographically secure. [[1]](diffhunk://#diff-7cd61a1ce3acb87dc3015b30bf9be7460e404e88671d64f2232d9a85ea9689fbR4) [[2]](diffhunk://#diff-7cd61a1ce3acb87dc3015b30bf9be7460e404e88671d64f2232d9a85ea9689fbL102-R106)
**Validation logic:**
* Updated the domain name regex in `isUrlValid()` in `server/lib/validators.ts` to more accurately validate domain names, preventing invalid formats.
**User input handling:**
* Applied `encodeURIComponent()` to the email parameter in the password reset link in `LoginForm.tsx`, preventing potential issues with special characters and improving security.
## How to test?
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/fosrl/pangolin/pull/1949
Author: @marcschaeferger
Created: 11/30/2025
Status: ✅ Merged
Merged: 12/6/2025
Merged by: @oschwartz10612
Base:
main← Head:fix-security/other📝 Commits (4)
fbbab60Potential fix for code scanning alert no. 7: Insecure randomness3eab3b0Potential fix for code scanning alert no. 8: DOM text reinterpreted as HTML8df62e8Potential fix for code scanning alert no. 19: Inefficient regular expression336d31cfix(validators): restore 2+ char domain label requirement📊 Changes
3 files changed (+5 additions, -4 deletions)
View changed files
📝
server/db/names.ts(+3 -2)📝
server/lib/validators.ts(+1 -1)📝
src/components/LoginForm.tsx(+1 -1)📄 Description
Community Contribution License Agreement
By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.
Description (generated by Copilot)
See
Code generated by Copilot
This pull request focuses on improving randomness, validation, and security in the codebase. The main changes include switching to cryptographically secure random number generation for name creation, refining URL validation logic, and ensuring safe encoding of user input in password reset links.
Randomness and security improvements:
Math.random()tocrypto.randomInt()ingenerateName()withinserver/db/names.ts, making name generation cryptographically secure. [1] [2]Validation logic:
isUrlValid()inserver/lib/validators.tsto more accurately validate domain names, preventing invalid formats.User input handling:
encodeURIComponent()to the email parameter in the password reset link inLoginForm.tsx, preventing potential issues with special characters and improving security.How to test?
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.