[souravC01]

Summary

Remediates four security and concurrency vulnerabilities covering token leakage in server logs, decompression safety in Word .doc file parsing, atomic storage quota reservation across concurrent uploads, and atomic single-transaction password reset token consumption.

---

Key Changes

1. Eliminate Sensitive Token Logging (backend/routers/auth.py, tests/test_auth_api.py):

   • Removed unconditional print() statements outputting raw email verification and password reset recovery links with usable tokens.
   • Replaced with sanitized operational log messages that exclude tokens and URLs.
   • Removed user account existence leak on invalid password reset requests.
   • Added automated test (test_tokens_not_printed_to_logs) capturing stdout/stderr to ensure no token leakage.

2. Enforce Decompression Safety Limit on Word .doc Files (backend/services/document_parser.py, tests/test_document_parser.py):

   • Unified decompression bomb safety verification so any zip-based archive (whether named .docx or .doc) is verified against the 50 MB uncompressed limit before invoking docx.Document.
   • Maintained friendly rejection for legacy non-zip binary Word files ("Legacy .doc binary format is not supported...").
   • Added tests ensuring renamed zip bombs are blocked, valid OOXML .doc files parse, and legacy binary .doc files are rejected.

3. Enforce Atomic Storage Quota Reservations (backend/storage.py, backend/services/resume_files.py, tests/test_atomic_limits.py):

   • Added reserve_upload_bytes and finalize_attachment methods to StorageService using transactional locking.
   • Included both active and reserved attachments in get_user_upload_bytes calculation.
   • Reserved storage quota atomically in the database before dispatching to object storage, releasing reservations to failed state on network or insertion failure.
   • Added automated concurrency test (test_concurrent_uploads_cannot_exceed_storage_quota) verifying simultaneous uploads obey exact storage quotas.

4. Atomic Password Reset & Verification Token Consumption (backend/storage.py, backend/routers/auth.py, tests/test_atomic_limits.py):

   • Added consume_reset_token_and_update_password to atomically validate the token, check expiration, consume it (used_at IS NULL), invalidate other prior tokens, and update the password and session version in a single transaction.
   • Added single-transaction verification consumption (consume_verify_token_and_verify_user) and hardened consume_auth_token to return rowcount boolean.
   • Added automated concurrency test (test_concurrent_password_reset_confirm_only_succeeds_once) confirming racing confirmation requests can only consume a token once.

---

Verification & Test Results

• Backend Pytest (pytest):
  • 211/211 passed in 36.96s (100% passing across all unit and concurrency suites).
• Frontend Vitest (npm test -- --run):
  • 47/47 passed across 13 test files.
• Frontend Build (npm run build):
  • Production build completed cleanly in 1.93s.
• Git Check (git diff --check):
  • Clean diff with zero whitespace or syntax issues.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
jobhelperguru	Ready	Preview	Sep 14, 2026 3:02am UTC