From 731c41d9283005f4e362c300702cbd79fd9d2606 Mon Sep 17 00:00:00 2001 From: Esc1200 Date: Sun, 7 Jun 2026 18:36:54 -0500 Subject: [PATCH] fix(security): remove server filesystem path from mission active POST response The POST /api/mission/active endpoint included the absolute server filesystem path (missionPath) in its success response. This leaks internal directory structure to API clients. Removed the 'path' field from the success response JSON. The path is still used internally for file operations but is no longer exposed to clients. --- src/routes/api/mission/active/+server.ts | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/src/routes/api/mission/active/+server.ts b/src/routes/api/mission/active/+server.ts index 1cec9bb4..45a41a8e 100644 --- a/src/routes/api/mission/active/+server.ts +++ b/src/routes/api/mission/active/+server.ts @@ -227,10 +227,9 @@ export const POST: RequestHandler = async ({ request }) => { await writeFile(missionPath, JSON.stringify(state, null, 2)); return json({ - success: true, - message: 'Mission state saved', - path: missionPath - }); + success: true, + message: 'Mission state saved' + }); } catch (error) { console.error('Failed to save active mission:', error); return json({