Skip to content

feat: security hardening suite (redaction, sanitization, yield tests, IPFS tests) - #211

Merged
Chucks1093 merged 1 commit into
StellarState:devfrom
robertocarlous:feature/security-hardening-group
Aug 25, 2026
Merged

feat: security hardening suite (redaction, sanitization, yield tests, IPFS tests)#211
Chucks1093 merged 1 commit into
StellarState:devfrom
robertocarlous:feature/security-hardening-group

Conversation

@robertocarlous

@robertocarlous robertocarlous commented Aug 25, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

closes #146
closes #147
closes #148
closes #149

Changes

#149 – Sensitive data redaction filter for Winston logger

  • Created src/observability/redaction-formatter.ts – custom Winston format that automatically redacts:
    • Stellar secret keys (S[A-Z0-9]{55}) to S***...***
    • JWT tokens to redacted form
    • Bearer Authorization headers to Bearer ***
    • Sensitive meta object keys (password, secret, token, etc.) to [REDACTED]
  • Attached redaction format to the Winston logger pipeline in src/observability/logger.ts

#148 – HTTP request payload sanitization middleware

  • Created src/middleware/sanitize-input.middleware.ts – Express middleware that recursively strips HTML/script tags from req.body and req.query string values using sanitize-html
  • Excludes binary Buffer uploads (multer) from sanitization
  • Registered globally in src/app.ts after express.json()

#147 – Unit tests for investment pro-rata yield distribution

  • Created tests/unit/services/investment-yield.test.ts with coverage for:
    • 2-investor (60/40, 50/50), 3-investor (equal, 70/20/10), and 10-investor splits
    • Platform fee rates: 0%, 1%, 2.5%
    • Assertion: payouts.reduce(a+b) + fee === settlement down to 1 stroop
    • Fractional stroop remainder edge cases
    • Single investor 100% scenarios
    • Zero division / NaN safety checks

#146 – Integration tests for IPFS upload retry & error handling

  • Created tests/integration/ipfs-upload.test.ts with coverage for:
    • 429 rate limit response followed by successful retry
    • Exponential backoff delay observation
    • File size exceeding 10MB fails instantly without calling IPFS gateway
    • Invalid MIME type rejection without API call
    • Network error and 500 error propagation as ServiceError
    • Successful upload returns correct hash/size/timestamp

Dependencies

  • Added sanitize-html and @types/sanitize-html to package.json (needs npm install)

@robertocarlous
feat: implement security hardening suite (Closes StellarState#149, St…
2da60ff 
…ellarState#148, StellarState#147, StellarState#146)

- StellarState#149: Add redaction formatter for Winston logger to mask Stellar secret keys, JWT tokens, Bearer tokens, and sensitive meta values
- StellarState#148: Add sanitize-input middleware to strip XSS/injection payloads from request bodies and query params
- StellarState#147: Add unit tests for pro-rata yield distribution across 2/3/10 investor splits with 0%/1%/2.5% fees
- StellarState#146: Add integration tests for IPFS upload retry on 429, file size validation, and error reporting
@robertocarlous robertocarlous mentioned this pull request Aug 25, 2026
Closed
@drips-wave

drips-wave Bot commented Aug 25, 2026

Copy link
Copy Markdown

@robertocarlous Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

@Chucks1093
Chucks1093 merged commit 9d14af3 into StellarState:dev Aug 25, 2026
2 of 3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment