goyban
1149687e3c
- Escape player names rendered via innerHTML on the hand-over and game-over
score rows (defense-in-depth XSS; names are already capped at 16 chars)
- app.disable('x-powered-by') to stop advertising Express
- Add safe response headers: X-Content-Type-Options, X-Frame-Options,
Referrer-Policy (no CSP — inline SW script + socket.io would need unsafe-inline)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
16 lines
304 B
JSON
16 lines
304 B
JSON
{
|
|
"name": "shelem",
|
|
"version": "1.1.7",
|
|
"description": "Shelem card game — multiplayer",
|
|
"main": "server.js",
|
|
"scripts": {
|
|
"start": "node server.js"
|
|
},
|
|
"dependencies": {
|
|
"express": "^4.18.2",
|
|
"socket.io": "^4.7.2",
|
|
"bcryptjs": "^2.4.3",
|
|
"jsonwebtoken": "^9.0.2"
|
|
}
|
|
}
|