Security Audit & Hardening Report

string targetFullPath = Path.GetFullPath(targetFolder);
if (!targetFullPath.EndsWith(Path.DirectorySeparatorChar.ToString()))
    targetFullPath += Path.DirectorySeparatorChar;

foreach (var entry in archive.Entries) {
    string cleanName = entry.FullName.Replace('\\', '/').TrimStart('/');
    string destPath = Path.GetFullPath(Path.Combine(targetFolder, cleanName));
    if (!destPath.StartsWith(targetFullPath, StringComparison.OrdinalIgnoreCase))
        throw new System.Security.SecurityException("Zip-Slip detected: " + entry.FullName);

    // Enforce Windows reserved device name validation
    string fileNameOnly = Path.GetFileName(cleanName);
    if (Regex.IsMatch(fileNameOnly, @"^(CON|PRN|AUX|NUL|COM[1-9]|LPT[1-9])(\..*)?$", RegexOptions.IgnoreCase))
        throw new System.Security.SecurityException("Reserved device name: " + entry.FullName);
}

CreditFlowController.prototype.abort = function(reason = new Error('Flow controller aborted')) {
    this.isAborted = true;
    this.abortReason = reason;
    while (this.waiters.length > 0) {
        const waiter = this.waiters.shift();
        try { if (waiter && typeof waiter.reject === 'function') waiter.reject(reason); } catch (_) {}
    }
};

OrderedReassemblyQueue.prototype.abort = function(reason = new Error('Reassembly queue aborted')) {
    this.hasError = true;
    this.abortReason = reason;
    for (const [, item] of this.buffer.entries()) {
        if (item && item.plainChunk && typeof item.plainChunk.fill === 'function') item.plainChunk.fill(0);
    }
    this.buffer.clear();
    while (this.drainWaiters.length > 0) {
        const waiter = this.drainWaiters.shift();
        try { if (waiter && typeof waiter.reject === 'function') waiter.reject(reason); } catch (_) {}
    }
};

const bodyDiv = document.createElement('div');
bodyDiv.className = 'toast-body';
bodyDiv.textContent = String(message || ''); // Strict text node escaping prevents DOM XSS

const closeBtn = document.createElement('button');
closeBtn.className = 'toast-close';
closeBtn.type = 'button';
closeBtn.textContent = '✕';

toast.appendChild(iconSpan);
toast.appendChild(bodyDiv);
toast.appendChild(closeBtn);

try {
    keyMaterial = await subtle.importKey('raw', passwordBytes, { name: 'PBKDF2' }, false, ['deriveBits']);
    const derivedBits = await subtle.deriveBits({ name: 'PBKDF2', salt, iterations, hash: 'SHA-512' }, keyMaterial, 256);
    rawKeyBytes = new Uint8Array(derivedBits);
    // ... optional keyfile XOR mixing ...
    return await subtle.importKey('raw', rawKeyBytes, { name: 'AES-GCM', length: 256 }, false, ['encrypt', 'decrypt']);
} finally {
    passwordBytes.fill(0);
    if (rawKeyBytes) rawKeyBytes.fill(0);
    if (mixedKey && mixedKey !== rawKeyBytes) mixedKey.fill(0);
    if (keyfileHash) keyfileHash.fill(0);
}

chunkCache: {
    _map: new Map(),
    _maxChunks: 4, // Max 16 MB plaintext RAM cap
    set(key, val) {
        if (this._map.has(key)) this._map.delete(key);
        else if (this._map.size >= this._maxChunks) {
            const oldestKey = this._map.keys().next().value;
            // Drop reference safely without in-place .fill(0) to avoid aliasing in multi-chunk extractions
            this._map.delete(oldestKey);
        }
        this._map.set(key, val);
        return this;
    },
    clear() {
        // Full cryptographic byte scrubbing strictly executed when session locks
        for (const chunk of this._map.values()) {
            if (chunk && typeof chunk.fill === 'function') chunk.fill(0);
        }
        this._map.clear();
    }
}

<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com data:; img-src 'self' data: blob:; media-src 'self' blob:; connect-src 'self' blob: data:; object-src 'none'; base-uri 'self';">

const secFetchSite = (request.headers && typeof request.headers.get === 'function')
    ? request.headers.get('Sec-Fetch-Site')
    : null;
if (secFetchSite && secFetchSite !== 'same-origin' && secFetchSite !== 'none') {
    event.respondWith(new Response('Forbidden', { status: 403 }));
    return;
}