chore(release): public-release readiness and security fixes for 1.1.16

Security:
- Escape user-supplied values in LDAP filters and DNs (group_ldap.js, user_ldap.js)
- Replace Math.random() token/UUID/OTP generation with crypto.randomUUID / crypto.randomInt
- Refuse startup when oauth.jwtSecret is missing or placeholder

Fixes:
- Correct from-address template rendering in email.js

Packaging:
- Remove private flag and bump version to 1.1.16

Co-Authored-By: Claude <noreply@anthropic.com>

CHANGELOG.md

@@ -6,6 +6,20 @@ correspond to git tags (`vX.Y.Z`) and `nodejs/package.json`'s `version`.
 
 ## [Unreleased]
 
+## [1.1.16] - 2026-07-18
+
+### Security
+- Hardened LDAP filter and DN construction against injection. All user-supplied values interpolated into group filters (`models/group_ldap.js`) and RDN values used when adding users/groups (`models/user_ldap.js`) are now escaped before being sent to the LDAP server.
+- Replaced `Math.random()`-based token generation in `models/token.js`, `models/oauth_code.js`, and `models/oauth_client.js` with `crypto.randomUUID()` for session tokens, OAuth codes, access/refresh tokens, and client IDs.
+- Replaced `Math.random()`-based OTP generation in `OtpToken.issue()` with `crypto.randomInt()`.
+- `routes/oauth.js` now refuses to start if `oauth.jwtSecret` is missing or still set to the placeholder value, instead of falling back to a hardcoded public string.
+
+### Changed
+- Public-release packaging: removed `"private": true` from `nodejs/package.json` and bumped version to `1.1.16`.
+
+### Fixed
+- `models/email.js`: fixed a template bug where the rendered `from` address used `template.message` instead of `template.from`.
+
 ## [1.1.15] - 2026-07-18
 
 ### Changed

nodejs/models/email.js

@@ -58,7 +58,7 @@ Mail.sendTemplate = async function(to, template, context, from){
 		to,
 		mustache.render(template.subject, context),
 		mustache.render(template.message, context),
-		from || (template.from && mustache.render(template.message, context))
+		from || (template.from && mustache.render(template.from, context))
 	)
 };
 

nodejs/models/group_ldap.js

@@ -4,6 +4,31 @@ const { Client, Attribute, Change } = require('ldapts');
 const { LRUCache } = require('lru-cache');
 const conf = require('@simpleworkjs/conf').ldap;
 
+// Escape a value used inside an LDAP search filter (RFC 4515).
+function escapeLDAPSearchValue(val) {
+	return String(val)
+		.replace(/\\/g, '\\5c')
+		.replace(/\*/g, '\\2a')
+		.replace(/\(/g, '\\28')
+		.replace(/\)/g, '\\29')
+		.replace(/\0/g, '\\00');
+}
+
+// Escape a value used in an LDAP DN (RFC 4514). Defensive: usernames/cns
+// are normally alphanumeric, but this prevents metacharacter injection.
+function escapeLDAPDNValue(val) {
+	return String(val)
+		.replace(/\\/g, '\\\\')
+		.replace(/,/g, '\\,')
+		.replace(/\+/g, '\\+')
+		.replace(/"/g, '\\"')
+		.replace(/</g, '\\<')
+		.replace(/>/g, '\\>')
+		.replace(/;/g, '\\;')
+		.replace(/=/g, '\\=')
+		.replace(/^\s|\s$/g, match => match === ' ' ? '\\ ' : match);
+}
+
 function makeClient() {
 	return new Client({ url: conf.url });
 }
@@ -19,7 +44,7 @@ async function withClient(fn) {
 }
 
 async function getGroups(client, member){
-	let memberFilter = member ? `(member=${member})`: ''
+	let memberFilter = member ? `(member=${escapeLDAPSearchValue(member)})`: ''
 
 	let groups = (await client.search(conf.groupBase, {
 		scope: 'sub',
@@ -35,7 +60,8 @@ async function getGroups(client, member){
 }
 
 async function addGroup(client, data){
-	await client.add(`cn=${data.name},${conf.groupBase}`, {
+	const safeName = escapeLDAPDNValue(data.name);
+	await client.add(`cn=${safeName},${conf.groupBase}`, {
 		cn: data.name,
 		member: data.owner,
 		description: data.description,
@@ -139,9 +165,10 @@ Group.get = async function(data){
 	}
 
 	return withClient(async (client) => {
+		const safeName = escapeLDAPSearchValue(data.name);
 		let group = (await client.search(conf.groupBase, {
 			scope: 'sub',
-			filter: `(&(objectClass=groupOfNames)(cn=${data.name}))`,
+			filter: `(&(objectClass=groupOfNames)(cn=${safeName}))`,
 			attributes: ['cn', 'description', 'member', 'owner', 'createTimestamp', 'modifyTimestamp'],
 		})).searchEntries[0];
 

nodejs/models/oauth_client.js

@@ -2,7 +2,8 @@
 
 const Table = require('.');
 const bcrypt = require('bcrypt');
-const UUID = function b(a){return a?(a^Math.random()*16>>a/4).toString(16):([1e7]+-1e3+-4e3+-8e3+-1e11).replace(/[018]/g,b)};
+const crypto = require('crypto');
+const UUID = () => crypto.randomUUID();
 const conf = require('@simpleworkjs/conf');
 
 const defaultLifetime = (conf.oauth && conf.oauth.token_lifetime) || {

nodejs/models/oauth_code.js

@@ -1,7 +1,8 @@
 'use strict';
 
 const Table = require('.');
-const UUID = function b(a){return a?(a^Math.random()*16>>a/4).toString(16):([1e7]+-1e3+-4e3+-8e3+-1e11).replace(/[018]/g,b)};
+const crypto = require('crypto');
+const UUID = () => crypto.randomUUID();
 
 // Shared base keyMap matching Token's schema so these behave as tokens
 const tokenKeyMap = {

nodejs/models/token.js

@@ -1,7 +1,8 @@
 'use strict';
 
 const Table = require('.');
-const UUID = function b(a){return a?(a^Math.random()*16>>a/4).toString(16):([1e7]+-1e3+-4e3+-8e3+-1e11).replace(/[018]/g,b)};
+const crypto = require('crypto');
+const UUID = () => crypto.randomUUID();
 
 
 class Token extends Table{
@@ -110,7 +111,7 @@ class OtpToken extends Token {
 		for (const t of existing) {
 			if (t.is_valid) await t.update({is_valid: false});
 		}
-		const code = String(Math.floor(100000 + Math.random() * 900000));
+		const code = String(crypto.randomInt(100000, 1000000));
 		return this.create({uid, code, method, created_by: uid});
 	}
 

nodejs/models/user_ldap.js

@@ -45,6 +45,20 @@ function escapeLDAPSearchValue(val) {
               .replace(/\0/g, '\\00');
 }
 
+// Escape a value used in an LDAP DN (RFC 4514).
+function escapeLDAPDNValue(val) {
+	return String(val)
+		.replace(/\\/g, '\\\\')
+		.replace(/,/g, '\\,')
+		.replace(/\+/g, '\\+')
+		.replace(/"/g, '\\"')
+		.replace(/</g, '\\<')
+		.replace(/>/g, '\\>')
+		.replace(/;/g, '\\;')
+		.replace(/=/g, '\\=')
+		.replace(/^\s|\s$/g, match => match === ' ' ? '\\ ' : match);
+}
+
 // Compute the next available uid/gidNumber: the highest existing value below
 // conf.uidGidReservedFloor, plus one -- or conf.uidGidMin if there are no
 // such entries yet. Entries at/above the reserved floor (e.g. a bootstrap
@@ -72,7 +86,8 @@ async function addPosixGroup(client, data){
 
 	data.gidNumber = nextPosixId(groups, 'gidNumber');
 
-	await client.add(`cn=${data.cn},${conf.groupBase}`, {
+	const safeCn = escapeLDAPDNValue(data.cn);
+	await client.add(`cn=${safeCn},${conf.groupBase}`, {
 	  cn: data.cn,
 	  gidNumber: data.gidNumber,
 	  objectclass: [ 'posixGroup', 'top' ]
@@ -94,6 +109,7 @@ async function addPosixAccount(client, data){
 
 	data.uidNumber = nextPosixId(people, 'uidNumber');
 
+	const safeCn = escapeLDAPDNValue(data.cn);
 	const entry = {
 		cn: data.cn,
 		sn: data.sn,
@@ -143,7 +159,7 @@ async function addPosixAccount(client, data){
 		entry.manager = [].concat(data.manager);
 	}
 
-	await client.add(`cn=${data.cn},${conf.userBase}`, entry);
+	await client.add(`cn=${safeCn},${conf.userBase}`, entry);
 
 	return data
 
@@ -799,7 +815,7 @@ User.addSSHkey = async function(data) {
 // memberUid (RFC 2307, posixGroup) is a bare username, not a DN, unlike
 // groupOfNames' `member` used by app_sso_* groups in group_ldap.js.
 function personalGroupDN(uid){
-	return `cn=${uid},${conf.groupBase}`;
+	return `cn=${escapeLDAPDNValue(uid)},${conf.groupBase}`;
 }
 
 User.getPersonalGroupMembers = async function(uid) {

nodejs/package.json

@@ -1,7 +1,6 @@
 {
   "name": "t42-sso-manager",
-  "version": "1.1.15",
+  "version": "1.1.16",
-  "private": true,
   "author": [
     {
       "name": "William Mantly",