Security hardening — round 9: 9 confirmed defects

[REPPL]

Automated security-hardening round 9. Each finding was surfaced by parallel hunters, survived an independent adversarial refuter, and ships with a reproduction test observed failing before the fix and passing after. 18 reproduction tests added (994 → 1012). No dependency changes.

Confirmed defects fixed

All reachable from an untrusted remote collection (loaded from allowlisted CDNs via user-pasted URLs / /gh/<user>/ share links) or a user-imported settings file, unless noted.

1. Relationship / single-file entity-array DoS (relationshipResolver.ts, collectionLoader.ts) — the relationships record is unbounded and type.field keyed, so a record whose keys all share the primary type's prefix collapsed into one bucket and made both the resolve pass and the per-card rank pass O(relationships × entities) again (round 7 bounded only the per-entity rebuild). Capped at MAX_RELATIONSHIPS; the single-file entity-array paths now share the MAX_ENTITY_IDS ceiling the index path enforced, removing the entity-count multiplier.
2. Uncapped settings field-options → DoS (useAvailableFields.ts) — every key of the sampled .loose() entities became an <option> in the settings sort/badge/group-by selectors, which render outside the collection error boundary, so an entity with tens of thousands of keys froze/OOM-killed the tab. Capped at MAX_AVAILABLE_FIELDS, stopping the per-card walk early.
3. Uncapped detail links → DoS (useCollection.ts) — card.detailUrls escaped MAX_MEDIA_PER_CARD (built from the uncapped detailUrls array plus one link per uncapped videos entry), so the sources overlay mounted an anchor + several URL parses per link with no windowing. Capped at MAX_DETAIL_LINKS_PER_CARD.
4. Unbounded rank-placeholder / UI label → DoS (settingsLoader.ts, collection.schema.ts) — a forced rankPlaceholderText and the v2 uiLabels.rankPlaceholder are rendered once per unranked card with no virtualisation, amplifying an unbounded string by the card count (the forced value persists globally). Forced value capped at ingress; v2 labels truncated in the schema (truncation, not rejection, so one long label cannot deny the whole collection load).
5. Uncapped settings-import fields (settingsExport.schema.ts) — the import schema accepted an unbounded searchFields array and rankPlaceholderText, the same values the collection loader already caps, which persist globally and follow the visitor to later collections. Both bounded on import.
6. Silent source loss on store-version bump (sourceStore.ts) — the store declares a persist version (already bumped 1→2→3) but no migrate, so a version mismatch handed undefined to merge, which threw on .sources; the swallowed throw discarded every configured source on upgrade. Added a migrate (carrying the persisted state forward so the existing dedup/legacy-cleanup runs as the migration) and made merge undefined-safe.
7. Platform & genre filters matched the wrong field (filterMatch.ts, FilterChips.tsx, CardGrid.tsx) — the Platform filter offered short-title options but matched the full categoryTitle (emptying the grid whenever they differed), and the Genre filter listed every genre but matched only each card's first. The field names, option source and match predicate now live in one module so the two sides cannot drift; array-valued fields match by membership; platform options are collected from the same categoryShort field the filter matches on. (Correctness, not security.)
8. Replace-import re-armed collection defaults (settingsExport.ts, settingsStore.ts) — the round-7/8 fix preserved hasAppliedCollectionDefaults but not appliedCollectionDefaultsSourceId, the marker applyCollectionSettings compares against the active source, so the active collection's settings.json defaults re-armed to clobber the just-imported values on the next load. Both markers are now snapshotted and restored (adding the missing setAppliedCollectionDefaultsSourceId action).

Considered and rejected (not fixed)

• tsc -b-emitted vite.config.js shadowing vite.config.ts — real, but the production build is a clean checkout so the shipped config never diverges; a local-dev staleness wart, not a security exposure.
• Committed Playwright test-results/ artefacts — tracked and un-gitignored, but the files carry no PII/secrets and there is no binary-trace leak channel on developer machines (traces only on CI retries, ephemeral workspace). Hygiene nitpick.
• ?reset=1 substring collision — latent: no preset query param exists or is planned, and the documented reset clears only local display settings.
• Imported-collection localStorage write — self-inflicted, deliberate-action-gated dead code; the quota-DoS reframing is unsubstantiated.
• Provider .. collection-path traversal spoof (two independent refuters) — grants nothing the design-intended ?collection= public-CDN route already grants; the loading screen even renders the traversal string.
• Snap-ranking mixed number/string badge values — real but low-likelihood, with graceful categorical degradation and the coincident value still winnable.

Verification

npm run typecheck, npm run lint (0 errors), npm run test (1012 pass), and npm run build all pass locally. npm audit --omit=dev reports 0 advisories in the production tree. Each behaviour change has a reproduction test observed failing on main and passing on this branch.