🛡️ Sentinel: [HIGH] Fix timingSafeEqual DoS Vulnerability (#423)

* Fix timingSafeEqual DoS Vulnerability in Webhook

Co-authored-by: ralksta <16941050+ralksta@users.noreply.github.com>

* Fix memory exhaustion DoS in token decoding

Co-authored-by: ralksta <16941050+ralksta@users.noreply.github.com>

---------

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>

lib/config/index.ts

@@ -2,9 +2,11 @@ import { env } from '../env';
 import { resolveAuthSecret } from '../secret';
 import { loadYaml, clearYamlCache, validateUuid } from './parser';
 import { resolveTheme, VALID_LAYOUTS } from './theme';
+import { ALBUM_SORT_MODES, isAlbumSortMode, type AlbumSortMode } from '../albumSort';
 import {
   slugify,
   AppConfig,
+  AlbumEntryObject,
   SubpageConfig,
   SubpageSectionConfig,
   SubpageObjectValue,
@@ -82,6 +84,8 @@ export interface GalleryDerivation {
   albumDescriptions: Record<string, string>;
   albumPasswords: Record<string, string>;
   albumHeroImages: Record<string, string>;
+  albumSortModes: Record<string, AlbumSortMode>;
+  albumManualOrders: Record<string, string[]>;
 }
 
 /**
@@ -99,14 +103,11 @@ export function deriveGallery(gallery: GalleryYaml): GalleryDerivation {
   const albumDescriptions: Record<string, string> = {};
   const albumPasswords: Record<string, string> = {};
   const albumHeroImages: Record<string, string> = {};
+  const albumSortModes: Record<string, AlbumSortMode> = {};
+  const albumManualOrders: Record<string, string[]> = {};
 
   function processAlbumEntry(
-    entry:
-      | string
-      | Record<
-          string,
-          string | { title: string; description?: string; password?: string; heroImage?: string }
-        >,
+    entry: string | Record<string, string | AlbumEntryObject>,
     context: string,
   ): string {
     if (typeof entry === 'string') {
@@ -133,6 +134,31 @@ export function deriveGallery(gallery: GalleryYaml): GalleryDerivation {
           `${context} heroImage for album ${validatedUuid}`,
         );
       }
+
+      // Throw rather than fall back to the default: a typo would otherwise be
+      // invisible — the album would just keep rendering in Immich order and the
+      // owner would be left wondering why the setting does nothing. Throwing
+      // also gives the admin PUT its 400 for free via the deriveGallery
+      // dry-run, and getConfigOrNull() degrades a hand-edited file to the setup
+      // screen rather than taking the site down. Name the album and the legal
+      // values so the log line is enough to fix it.
+      if (value.sort != null) {
+        if (!isAlbumSortMode(value.sort)) {
+          throw new Error(
+            `${context}: album ${validatedUuid} has an unknown sort "${value.sort}". ` +
+              `Valid values are: ${ALBUM_SORT_MODES.join(', ')}.`,
+          );
+        }
+        albumSortModes[validatedUuid] = value.sort;
+      }
+
+      // Kept regardless of the mode, so switching manual → newest → manual does
+      // not silently destroy a hand-curated order.
+      if (value.assetOrder?.length) {
+        albumManualOrders[validatedUuid] = value.assetOrder.map((assetId, i) =>
+          validateUuid(assetId, `${context} assetOrder[${i}] for album ${validatedUuid}`),
+        );
+      }
     }
     return validatedUuid;
   }
@@ -240,6 +266,8 @@ export function deriveGallery(gallery: GalleryYaml): GalleryDerivation {
     albumDescriptions,
     albumPasswords,
     albumHeroImages,
+    albumSortModes,
+    albumManualOrders,
   };
 }
 
@@ -287,6 +315,8 @@ export function getConfig(): AppConfig {
       albumDescriptions: {},
       albumPasswords: {},
       albumHeroImages: {},
+      albumSortModes: {},
+      albumManualOrders: {},
       cacheTtl: env.CACHE_TTL * 1000,
       staleMaxAge: env.STALE_MAX_AGE * 1000,
       immichTimeoutMs: env.IMMICH_TIMEOUT_MS,
@@ -306,6 +336,8 @@ export function getConfig(): AppConfig {
     albumDescriptions,
     albumPasswords,
     albumHeroImages,
+    albumSortModes,
+    albumManualOrders,
   } = deriveGallery(gallery);
 
   const siteSeoTitle = settings.seo?.title || settings.title || env.SITE_TITLE || 'Gallery';
@@ -378,6 +410,8 @@ export function getConfig(): AppConfig {
     albumDescriptions,
     albumPasswords,
     albumHeroImages,
+    albumSortModes,
+    albumManualOrders,
     cacheTtl: env.CACHE_TTL * 1000,
     staleMaxAge: env.STALE_MAX_AGE * 1000,
     immichTimeoutMs: env.IMMICH_TIMEOUT_MS,

lib/config/schema.ts

@@ -1,3 +1,5 @@
+import type { AlbumSortMode } from '../albumSort';
+
 export interface SubpageSectionConfig {
   title: string;
   slug: string; // auto-derived from title, used as anchor
@@ -29,15 +31,14 @@ export interface SubpageObjectValue {
   essayFile?: string;
   essayText?: string;
   enabled?: boolean;
-  albums?: Array<
-    string | Record<string, string | { title: string; description?: string; password?: string }>
-  >;
+  // Both album lists reuse AlbumEntryObject rather than inlining the shape:
+  // the inline copies had already drifted (they never gained `heroImage`), and
+  // this path is live for map-style subpages.
+  albums?: Array<string | Record<string, string | AlbumEntryObject>>;
   sections?: Array<{
     title: string;
     description?: string;
-    albums: Array<
-      string | Record<string, string | { title: string; description?: string; password?: string }>
-    >;
+    albums: Array<string | Record<string, string | AlbumEntryObject>>;
   }>;
 }
 
@@ -112,6 +113,10 @@ export interface AppConfig {
   albumDescriptions: Record<string, string>;
   albumPasswords: Record<string, string>;
   albumHeroImages: Record<string, string>;
+  /** Per-album sort mode. Absent means `immich` — the album's own order. */
+  albumSortModes: Record<string, AlbumSortMode>;
+  /** Pinned asset UUIDs per album for `sort: manual`, in display order. */
+  albumManualOrders: Record<string, string[]>;
   cacheTtl: number;
   /** How long (ms) an expired cache entry may still be served while Immich is unreachable. */
   staleMaxAge: number;
@@ -133,10 +138,18 @@ export interface AppConfig {
 }
 
 export interface AlbumEntryObject {
-  title: string;
+  /** Optional: an entry may carry only a sort mode and no title override. */
+  title?: string;
   description?: string;
   password?: string;
   heroImage?: string;
+  /**
+   * Raw YAML shape — narrowed to `AlbumSortMode` in deriveGallery(), which is
+   * where an unknown value has to be rejected with a message a human can act on.
+   */
+  sort?: string;
+  /** Pinned asset UUIDs for `sort: manual`. Everything else follows automatically. */
+  assetOrder?: string[];
 }
 
 export interface GalleryYaml {