1. The Core Thesis: Why Strong Crypto is Never Enough

A common pitfall in secure software engineering is relying solely on cryptographic algorithms to secure a system. An application can employ mathematically flawless AES-GCM or RSA-4096 tunnels, yet remain entirely vulnerable to compromise if its architectural foundation is weak. If an attacker can exploit a Path Traversal bug to read the server's .env configuration file, they will extract the raw database keys and JWT secrets, rendering the database encryption useless. If the process runs with root privileges, any remote code execution (RCE) grants host takeover. If the UI lacks protocol sanitization, an attacker can bypass encryption entirely by injecting an XSS payload that exfiltrates decrypted messages straight from client memory. Quasar's design demonstrates that true security is a function of system-wide architectural hardening.

2. OS Execution Hardening & System Restraints

Quasar implements defenses at the boundary between the application and the host operating system, reducing the potential impact of exploits:

• // PRIVILEGE REDUCTION & CONTAINER SECURITY: The server checks process.getuid() === 0 at startup. If executed inside a root context, it immediately aborts. This prevents attackers from gaining full root access to the host kernel or docker host interface if they find an application exploit, suppressing privilege escalation vectors.
• // DYNAMIC RUNTIME TAMPER MITIGATION (FIM): Memory injection and hot-patching are active threats to Node.js servers. The continuous fs.watch() daemon monitors core modules. If any script is altered on disk or dynamic patch attempts are made, the server shuts down immediately. This mitigates persistent server-side malware implants.

3. Sandboxed File Operations & Sandboxed Routing

File uploads are high-risk entry points. Quasar sandboxes files on disk and isolates them at the routing level to mitigate path traversals and arbitrary system reading:

• // FILENAME SANITIZATION & METADATA SEPARATION: When a file is uploaded, the original name is encrypted in the SQLite DB. On disk, the file is saved under a cryptographically random UUID v4 string (e.g. data/uploads/9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d). This destroys the original extension and name, blocking attackers from uploading executable scripts (e.g. .js or .php) and triggering them on the host.
• // REGEX UUID PATH TRAVERSAL DEFENSE: The download route /file/:id utilizes a strict UUID validation regex: /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i. If an attacker submits a path-traversal request (e.g. /file/../../.env), the server rejects it at the regex layer, preventing unauthorized system file extraction.

4. API Rate Limiting & Denial of Service (DoS) Hardening

To prevent memory depletion and application lockups caused by abuse, Quasar includes active DoS protection mechanisms:

• // SLIDING-WINDOW API LIMITER: The socket.io handlers and authentication routes are bounded by sliding-window rate limit maps. IPs that exceed 5 events per second are temporarily throttled, neutralizing brute-force password checking and automated message flooding.
• // STREAM BUFFER SIZE RESTRICTION: Upload streams are dynamically bounded. The server monitors incoming chunks in real-time, aborting the request, destroying the active write stream, and deleting the temporary disk buffer instantly if the upload size exceeds MAX_UPLOAD_BYTES. This mitigates RAM starvation and disk-fill attacks.

5. DOM-Level Sanitization & XSS Prevention

Cross-Site Scripting (XSS) is a critical threat to E2EE chats. If an attacker can inject and run JavaScript inside another client's browser, they can extract the E2EE keys or read raw chat texts directly. Quasar mitigates this through defensive measures:

• // PROTOCOL WHITELIST FILTERING: To prevent malicious URLs from injecting javascript (e.g. <img src="javascript:alert(1)">) inside user avatar links, the React component UserList.jsx parses and checks incoming links against strict protocol schemes (http:, https:, and safe data:image/ types), stripping malicious protocols instantly.
• // GLOBAL CONTENT-SECURITY-POLICY (CSP) RESTRICTIONS: The backend applies strict CSP headers on every request. Scripts can only be executed if they originate from 'self' or strict verified CDNs. Object injections are disabled (object-src 'none'), base URI modifications are banned (base-uri 'none'), and framing is completely disabled (X-Frame-Options: DENY) to prevent Clickjacking and script injection bypasses.