🛡️ Sentinel: [HIGH] Fix timingSafeEqual DoS Vulnerability (#423)

* Fix timingSafeEqual DoS Vulnerability in Webhook

Co-authored-by: ralksta <16941050+ralksta@users.noreply.github.com>

* Fix memory exhaustion DoS in token decoding

Co-authored-by: ralksta <16941050+ralksta@users.noreply.github.com>

---------

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>

app/api/admin/albums/[albumId]/assets/__tests__/route.test.ts

@@ -0,0 +1,96 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { NextRequest } from 'next/server';
+
+vi.mock('@/lib/admin/auth', () => ({
+  isAdminEnabled: () => true,
+  isAdminAuthenticated: async () => true,
+}));
+
+vi.mock('@/lib/config', () => ({
+  getConfig: () => ({ needsSetup: false }),
+}));
+
+const getAlbumAssetsRaw = vi.fn();
+vi.mock('@/lib/immich', () => ({
+  immich: {
+    get getAlbumAssetsRaw() {
+      return getAlbumAssetsRaw;
+    },
+  },
+}));
+
+import { GET } from '../route';
+
+const ALBUM = '11111111-1111-1111-1111-111111111111';
+
+const asset = (id: string, type: 'IMAGE' | 'VIDEO') => ({
+  id,
+  type,
+  originalFileName: `${id}.jpg`,
+  fileCreatedAt: '2024-01-01T00:00:00.000Z',
+  isFavorite: false,
+});
+
+const call = (albumId: string, query = '') =>
+  GET(new NextRequest(`http://localhost/api/admin/albums/${albumId}/assets${query}`), {
+    params: Promise.resolve({ albumId }),
+  });
+
+describe('GET /api/admin/albums/[albumId]/assets', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    getAlbumAssetsRaw.mockResolvedValue([
+      asset('img-1', 'IMAGE'),
+      asset('vid-1', 'VIDEO'),
+      asset('img-2', 'IMAGE'),
+    ]);
+  });
+
+  // Without this, `..%2f..%2fusers` resolves inside fetch() to an arbitrary
+  // Immich endpoint, called with the server's API key.
+  it('rejects an album ID that is not a UUID', async () => {
+    const res = await call('..%2f..%2fusers');
+
+    expect(res.status).toBe(400);
+    expect(getAlbumAssetsRaw).not.toHaveBeenCalled();
+  });
+
+  it('returns images only by default, so the hero picker is unaffected', async () => {
+    const res = await call(ALBUM);
+    const body = await res.json();
+
+    expect(res.status).toBe(200);
+    expect(body.assets.map((a: { id: string }) => a.id)).toEqual(['img-1', 'img-2']);
+  });
+
+  // The public grid renders videos, so the sort editor has to be able to pin
+  // one — otherwise a video could only ever sit in the unpinned tail.
+  it('includes videos when types=all', async () => {
+    const res = await call(ALBUM, '?types=all');
+    const body = await res.json();
+
+    expect(body.assets.map((a: { id: string }) => a.id)).toEqual(['img-1', 'vid-1', 'img-2']);
+  });
+
+  /**
+   * Immich 3.x stopped embedding assets in `GET /albums/:id`, which is what
+   * this route used to read — so it returned nothing, and threw outright when
+   * the key was absent. It has to go through the client's paginated metadata
+   * search instead.
+   */
+  it('reads assets through the Immich client rather than the album endpoint', async () => {
+    await call(ALBUM);
+
+    expect(getAlbumAssetsRaw).toHaveBeenCalledWith(ALBUM);
+  });
+
+  it('reports an upstream failure as a 500 rather than an empty album', async () => {
+    getAlbumAssetsRaw.mockRejectedValue(new Error('immich down'));
+    const err = vi.spyOn(console, 'error').mockImplementation(() => {});
+
+    const res = await call(ALBUM);
+
+    expect(res.status).toBe(500);
+    err.mockRestore();
+  });
+});

app/api/admin/albums/[albumId]/assets/route.ts

@@ -1,25 +1,16 @@
 /**
- * Admin API: Get assets of a specific album for the hero image picker.
+ * Admin API: assets of a specific album, for the hero image picker and the
+ * manual sort editor.
  */
 
 import { NextRequest, NextResponse } from 'next/server';
 import { isAdminAuthenticated, isAdminEnabled } from '@/lib/admin/auth';
 import { getConfig } from '@/lib/config';
+import { immich } from '@/lib/immich';
 import { isUuid } from '@/lib/uuid';
 
-interface ImmichAlbumDetail {
-  assets: Array<{
-    id: string;
-    type: string;
-    originalFileName: string;
-    thumbhash: string | null;
-    fileCreatedAt: string;
-    isFavorite: boolean;
-  }>;
-}
-
 export async function GET(
-  _request: NextRequest,
+  request: NextRequest,
   { params }: { params: Promise<{ albumId: string }> },
 ) {
   if (!isAdminEnabled()) {
@@ -42,27 +33,27 @@ export async function GET(
     return NextResponse.json({ error: 'Invalid album ID' }, { status: 400 });
   }
 
+  // Videos are opt-in. The hero picker feeds imageUrl()/assetPlaceholder and
+  // wants images only; the sort editor must show everything the public grid
+  // renders, or a video could never be pinned and would always fall to the tail.
+  const includeVideos = request.nextUrl.searchParams.get('types') === 'all';
+
   try {
-    const res = await fetch(`${config.immich.apiUrl}/albums/${encodeURIComponent(albumId)}`, {
-      headers: {
-        'x-api-key': config.immich.apiKey,
-        Accept: 'application/json',
-      },
-    });
+    // Via the client, not a bare fetch of `GET /albums/:id`: Immich 3.x no
+    // longer embeds assets in that response, so reading `album.assets` returned
+    // nothing (and threw outright when the key was absent). getAlbumAssetsRaw()
+    // pages through the metadata search and applies the album's own order, so
+    // this list matches what the site renders under `sort: immich`.
+    const all = await immich.getAlbumAssetsRaw(albumId);
 
-    if (!res.ok) {
-      return NextResponse.json({ error: `Immich API returned ${res.status}` }, { status: 502 });
-    }
-
-    const album = (await res.json()) as ImmichAlbumDetail;
-
-    const assets = album.assets
-      .filter((a) => a.type === 'IMAGE')
+    const assets = all
+      .filter((a) => a.type === 'IMAGE' || (includeVideos && a.type === 'VIDEO'))
       .map((a) => ({
         id: a.id,
+        type: a.type,
         originalFileName: a.originalFileName,
         fileCreatedAt: a.fileCreatedAt,
-        isFavorite: a.isFavorite,
+        isFavorite: a.isFavorite ?? false,
       }));
 
     return NextResponse.json({ assets, nextPage: null });