fix(security): resolve Medium findings from the security review by bannarisoftwares · Pull Request #449 · dculussoftwares/dculus-forms

bannarisoftwares · 2026-10-29T16:23:48Z

Summary

Remediates the Medium findings (S01–S24) from the security review, across backend, UI and infra. Each finding was re-verified against current code first; some were already fixed by #442/#445/#447.

Highlights

Access/validation: server-side answer validation against the live schema, view-count dedupe, duplicate-form needs EDITOR, publishing automations with external actions needs OWNER, narrower admin/billing actions.
Uploads/exports/OAuth: file-signature checks, CSV formula neutralisation, OAuth state nonces (form-app + form-viewer), quiz regex ReDoS guard, PDF/ZIP generation caps.
Billing/data: Chargebee webhook idempotency + ordering (500 on failure so Chargebee retries), past_due no longer overwritten, org deletion disabled, OAuth tokens encrypted at rest, scheduled retention purge, audit log scoped by org.
Infra/CI: actions pinned to SHAs, no credentialed Terraform on PRs, Azure secrets as Container App secrets, security headers on Cloudflare apps, extended pnpm overrides, blocking prod audit gate.
UI: en/ta strings, 15-min schedule validation, hidden Duplicate for VIEWERs, AI chat limits/toasts, unverified-rationale label.

Deploy notes

Run db:migrate:deploy: 20261021120000_webhook_idempotency_audit_org.
First release after merge needs a build run that produced the image-digest artifact, otherwise release.yml fails at retag.
EDITORs can no longer publish/activate automations using email/webhook/sheets actions.

Not done (needs infra/product decision or admin settings)

See the tracker in docs/security-review/SECURITY_REVIEW_SECTIONS.md and "Medium findings — manual steps" in REMEDIATION.md.

Testing

tsc clean (all packages), backend 4280 tests + coverage thresholds, form-viewer/types/ui tests, eslint clean. Four RailPageGroup form-app tests fail on main too (pre-existing).

Backend, UI and infra remediation for the Medium findings across S01-S24: answer validation, upload/CSV/OAuth hardening, billing webhook idempotency, automation/plugin permissions and limits, audit/retention, CI and Terraform hardening, dependency overrides. Manual follow-ups are in REMEDIATION.md. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

qodo-code-review · 2026-10-29T16:23:55Z

ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing

coderabbitai · 2026-10-29T16:24:00Z

Important

Review skipped

Too many files!

This PR contains 207 files, which is 57 over the limit of 150.

To get a review, reduce the PR to 150 files or fewer by splitting it into smaller PRs or changing its base branch.

Upgrade to Team to raise the limit.

This review couldn't start because sufficient usage credits or metered capacity aren't available. Add credits or update usage-based reviews in the billing tab, then retry.

Run configuration

Source mode: Auto
Repository: dculussoftwares/dculus-forms
Branch: fix/security-review-medium-findings
File: .coderabbit.yaml
Commit: 692491a
Layers: Repository YAML
Review profile: CHILL
Plan: Essentials
Run ID: e59d9161-190f-4dba-9bb2-1301ebe21a82

Commits

Reviewing files that changed from the base of the PR and between 41c3f3f and 692491a.

Files ignored due to path filters: 2

apps/backend/prisma/migrations/20261021120000_webhook_idempotency_audit_org/migration.sql is excluded by !apps/backend/prisma/migrations/**
pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml, !**/pnpm-lock.yaml

Files selected for processing: 207

.github/actions/fetch-frontend-build/action.yml
.github/actions/setup/action.yml
.github/audit-allowlist.json
.github/copilot-instructions.md
.github/dependabot.yml
.github/instructions/testing.instructions.md
.github/scripts/audit-prod.mjs
.github/workflows/ai-evals.yml
.github/workflows/build.yml
.github/workflows/codeql.yml
.github/workflows/multi-cloud-deployment.yml
.github/workflows/multi-cloud-destroy.yml
.github/workflows/release.yml
PGBOUNCER-MIGRATION.md
apps/admin-app/README.md
apps/admin-app/public/_headers
apps/backend/.env.example
apps/backend/prisma/schema.prisma
apps/backend/src/graphql/resolvers/__tests__/admin.test.ts
apps/backend/src/graphql/resolvers/__tests__/analytics.test.ts
apps/backend/src/graphql/resolvers/__tests__/automations.test.ts
apps/backend/src/graphql/resolvers/__tests__/better-auth.test.ts
apps/backend/src/graphql/resolvers/__tests__/fileUpload.test.ts
apps/backend/src/graphql/resolvers/__tests__/formFiles.test.ts
apps/backend/src/graphql/resolvers/__tests__/formSharing.test.ts
apps/backend/src/graphql/resolvers/__tests__/forms.test.ts
apps/backend/src/graphql/resolvers/__tests__/responses.test.ts
apps/backend/src/graphql/resolvers/__tests__/subscriptions.test.ts
apps/backend/src/graphql/resolvers/admin.ts
apps/backend/src/graphql/resolvers/analytics.ts
apps/backend/src/graphql/resolvers/automations.ts
apps/backend/src/graphql/resolvers/fileUpload.ts
apps/backend/src/graphql/resolvers/formFiles.ts
apps/backend/src/graphql/resolvers/formSharing.ts
apps/backend/src/graphql/resolvers/forms.ts
apps/backend/src/graphql/resolvers/pdfGenerators.ts
apps/backend/src/graphql/resolvers/pdfTemplates.ts
apps/backend/src/graphql/resolvers/responses.ts
apps/backend/src/graphql/resolvers/subscriptions.ts
apps/backend/src/index.ts
apps/backend/src/lib/__tests__/authAccess.test.ts
apps/backend/src/lib/__tests__/authAudit.test.ts
apps/backend/src/lib/__tests__/databaseUrl.test.ts
apps/backend/src/lib/__tests__/env.test.ts
apps/backend/src/lib/__tests__/formViewDedupe.test.ts
apps/backend/src/lib/__tests__/graphqlErrorSanitizer.test.ts
apps/backend/src/lib/__tests__/invitationRateLimit.test.ts
apps/backend/src/lib/__tests__/responseAnswerValidation.test.ts
apps/backend/src/lib/__tests__/responsePayloadLimits.test.ts
apps/backend/src/lib/__tests__/spreadsheetSafety.test.ts
apps/backend/src/lib/__tests__/userDataErasure.test.ts
apps/backend/src/lib/audit.ts
apps/backend/src/lib/authAccess.ts
apps/backend/src/lib/authAudit.ts
apps/backend/src/lib/better-auth.ts
apps/backend/src/lib/databaseUrl.ts
apps/backend/src/lib/emailAddress.ts
apps/backend/src/lib/env.ts
apps/backend/src/lib/fileSignature.ts
apps/backend/src/lib/formViewDedupe.ts
apps/backend/src/lib/graphqlErrors.ts
apps/backend/src/lib/invitationRateLimit.ts
apps/backend/src/lib/oauthState.ts
apps/backend/src/lib/prisma.ts
apps/backend/src/lib/responseAnswerValidation.ts
apps/backend/src/lib/responsePayloadLimits.ts
apps/backend/src/lib/spreadsheetSafety.ts
apps/backend/src/lib/userDataErasure.ts
apps/backend/src/plugins/ai-tagger/__tests__/handler.test.ts
apps/backend/src/plugins/ai-tagger/handler.ts
apps/backend/src/plugins/core/__tests__/executor.test.ts
apps/backend/src/plugins/core/__tests__/pdfGeneratorAutoRun.test.ts
apps/backend/src/plugins/core/executor.ts
apps/backend/src/plugins/core/pdfGeneratorAutoRun.ts
apps/backend/src/plugins/email/__tests__/handler.test.ts
apps/backend/src/plugins/email/handler.ts
apps/backend/src/plugins/microsoft-sheets/handler.ts
apps/backend/src/repositories/__tests__/formFileRepository.test.ts
apps/backend/src/repositories/__tests__/formRepository.test.ts
apps/backend/src/repositories/__tests__/pdfGeneratorRepository.test.ts
apps/backend/src/repositories/automationRepository.ts
apps/backend/src/repositories/dataRetentionRepository.ts
apps/backend/src/repositories/formFileRepository.ts
apps/backend/src/repositories/formRepository.ts
apps/backend/src/repositories/index.ts
apps/backend/src/repositories/pdfGeneratorRepository.ts
apps/backend/src/repositories/pluginRepository.ts
apps/backend/src/repositories/subscriptionRepository.ts
apps/backend/src/repositories/webhookEventRepository.ts
apps/backend/src/routes/__tests__/aiChat.test.ts
apps/backend/src/routes/__tests__/chargebee-webhooks.test.ts
apps/backend/src/routes/__tests__/oauthRoutes.test.ts
apps/backend/src/routes/__tests__/upload.test.ts
apps/backend/src/routes/aiChat.ts
apps/backend/src/routes/chargebee-webhooks.ts
apps/backend/src/routes/google-oauth.ts
apps/backend/src/routes/microsoft-oauth.ts
apps/backend/src/routes/upload.ts
apps/backend/src/services/__tests__/automationService.test.ts
apps/backend/src/services/__tests__/chargebeeService.test.ts
apps/backend/src/services/__tests__/collaborationConnections.test.ts
apps/backend/src/services/__tests__/copyFormPlugins.test.ts
apps/backend/src/services/__tests__/dataRetentionService.test.ts
apps/backend/src/services/__tests__/fileUploadService.test.ts
apps/backend/src/services/__tests__/formDeletionCleanup.test.ts
apps/backend/src/services/__tests__/myResponseService.test.ts
apps/backend/src/services/__tests__/pdfGeneratorZipService.test.ts
apps/backend/src/services/__tests__/pdfTemplateService.test.ts
apps/backend/src/services/__tests__/responseCopyService.test.ts
apps/backend/src/services/__tests__/responseQueryBuilder.test.ts
apps/backend/src/services/__tests__/responseService.test.ts
apps/backend/src/services/__tests__/responseServiceAdditional.test.ts
apps/backend/src/services/__tests__/unifiedExportService.test.ts
apps/backend/src/services/automation/__tests__/copyAutomation.test.ts
apps/backend/src/services/automation/__tests__/cronValidator.test.ts
apps/backend/src/services/automation/__tests__/graphValidator.test.ts
apps/backend/src/services/automation/copyAutomation.ts
apps/backend/src/services/automation/cronValidator.ts
apps/backend/src/services/automation/externalDelivery.ts
apps/backend/src/services/automation/graphValidator.ts
apps/backend/src/services/automation/limits.ts
apps/backend/src/services/automationService.ts
apps/backend/src/services/chargebeeService.ts
apps/backend/src/services/collaborationConnections.ts
apps/backend/src/services/copyFormPlugins.ts
apps/backend/src/services/dataRetentionService.ts
apps/backend/src/services/emailService.ts
apps/backend/src/services/fileUploadService.ts
apps/backend/src/services/formDeletionCleanup.ts
apps/backend/src/services/formService.ts
apps/backend/src/services/formSharingService.ts
apps/backend/src/services/hocuspocus.ts
apps/backend/src/services/myResponseService.ts
apps/backend/src/services/pdfGenerationJobService.ts
apps/backend/src/services/pdfGeneratorService.ts
apps/backend/src/services/pdfGeneratorZipService.ts
apps/backend/src/services/pdfTemplateService.ts
apps/backend/src/services/quiz/__tests__/gradingEngine.test.ts
apps/backend/src/services/quiz/gradingEngine.ts
apps/backend/src/services/responseCopyService.ts
apps/backend/src/services/responseQueryBuilder.ts
apps/backend/src/services/responseService.ts
apps/backend/src/services/unifiedExportService.ts
apps/backend/src/subscriptions/__tests__/usageService.test.ts
apps/backend/src/subscriptions/usageService.ts
apps/backend/src/templates/__tests__/formPublishedEmail.test.ts
apps/backend/src/templates/__tests__/invitationEmail.test.ts
apps/backend/src/templates/__tests__/responseCopyEmail.test.ts
apps/backend/src/templates/formPublishedEmail.ts
apps/backend/src/templates/invitationEmail.ts
apps/backend/src/templates/responseCopyEmail.ts
apps/form-app/public/_headers
apps/form-app/src/components/FormDashboard/FormHeader.tsx
apps/form-app/src/components/automations/builder/ScheduleTriggerEditor.tsx
apps/form-app/src/components/automations/builder/__tests__/scheduleCronValidation.test.ts
apps/form-app/src/components/automations/builder/scheduleCronValidation.ts
apps/form-app/src/components/form-builder/AIEditDrawer.tsx
apps/form-app/src/components/form-builder/tool-parts/PluginProposalCard.tsx
apps/form-app/src/components/settings/BillingSettings.tsx
apps/form-app/src/components/sharing/ShareModal.tsx
apps/form-app/src/hooks/useAIChat.ts
apps/form-app/src/lib/__tests__/pendingConfigFields.test.ts
apps/form-app/src/lib/pendingConfigFields.ts
apps/form-app/src/locales/en/aiEditDrawer.json
apps/form-app/src/locales/en/automations.json
apps/form-app/src/locales/en/emailPluginConfig.json
apps/form-app/src/locales/en/pricing.json
apps/form-app/src/locales/en/quizGrading.json
apps/form-app/src/locales/en/settings.json
apps/form-app/src/locales/ta/aiEditDrawer.json
apps/form-app/src/locales/ta/automations.json
apps/form-app/src/locales/ta/emailPluginConfig.json
apps/form-app/src/locales/ta/pricing.json
apps/form-app/src/locales/ta/quizGrading.json
apps/form-app/src/locales/ta/settings.json
apps/form-app/src/pages/FormDashboard.tsx
apps/form-app/src/pages/PdfTemplateDesigner.tsx
apps/form-app/src/pages/PdfTemplates.tsx
apps/form-app/src/pages/Pricing.tsx
apps/form-app/src/plugins/email/ConfigForm.tsx
apps/form-app/src/plugins/google-sheets/ConfigForm.tsx
apps/form-app/src/plugins/microsoft-sheets/ConfigForm.tsx
apps/form-viewer/public/_headers
apps/form-viewer/src/components/SignInOptions.tsx
apps/form-viewer/src/lib/oauthNonce.test.ts
apps/form-viewer/src/lib/oauthNonce.ts
apps/form-viewer/src/pages/FormViewer.tsx
apps/form-viewer/src/pages/OAuthCallback.tsx
docker-compose.yml
docs/deployment/GITHUB_SECRETS_SETUP.md
docs/security-review/REMEDIATION.md
docs/security-review/SECURITY_REVIEW_SECTIONS.md
infrastructure/multi-cloud/terraform/azure/environments/dev/terraform.tfvars
infrastructure/multi-cloud/terraform/azure/environments/staging/terraform.tfvars
infrastructure/multi-cloud/terraform/azure/main.tf
infrastructure/multi-cloud/terraform/cloudflare/r2-api-token.tf
lefthook.yml
package.json
packages/types/src/__tests__/regexSafety.test.ts
packages/types/src/quiz.ts
packages/types/src/validation.ts
test-production-backend.sh
test-users-management.sh
test/e2e/features/response-filters.feature
test/e2e/steps/helpers/common.ts
test/integration/step-definitions/response-filtering.steps.ts
test/integration/utils/test-data.ts

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

Reserve a plan submission slot with a single conditional UPDATE before the response insert and release it if the insert fails, instead of checking then incrementing via a fire-and-forget event. trackFormSubmission is now notification-only. Previews are not counted. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…idation Some form rows store formSchema as a JSON-encoded string; the S04-04 validator rejected them as unavailable, breaking submissions. Parse strings first and still fail closed on invalid JSON. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

The response answer validation (S04-04) now enforces the form schema, which exposed fixtures using uppercase field types and lowercase dropdown values that are not valid for the schema. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…e tracker Adds a Medium open column and a table of open Medium findings with reasons, taken from the #449 triage and REMEDIATION.md. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

bannarisoftwares requested review from arunkumardursaisamy66, natheeshsunway and prabu-naveen as code owners October 29, 2026 16:23

Natheeshkumar and others added 4 commits October 29, 2026 21:59

fix(security): hide checkout for non-owners on the Pricing page

692491a

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

bannarisoftwares merged commit c645deb into main Oct 29, 2026
38 checks passed

Navigation Menu

Repository navigation

fix(security): resolve Medium findings from the security review - #449

fix(security): resolve Medium findings from the security review#449
bannarisoftwares merged 5 commits into
mainfrom
fix/security-review-medium-findings

bannarisoftwares commented Oct 29, 2026

Uh oh!

qodo-code-review Bot commented Oct 29, 2026

Uh oh!

coderabbitai Bot commented Oct 29, 2026 •

edited

Loading

Review skipped

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

bannarisoftwares commented Oct 29, 2026

Summary

Highlights

Deploy notes

Not done (needs infra/product decision or admin settings)

Testing

Uh oh!

qodo-code-review Bot commented Oct 29, 2026

Uh oh!

coderabbitai Bot commented Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

coderabbitai Bot commented Oct 29, 2026 •

edited

Loading