infiplot-web

Files

T

Zonghao Yuan c30d11d60b fix(security): harden BYO API header against SSRF and input abuse (#33 )

* fix(security): harden BYO API header against SSRF and input abuse

- Add lib/validateUrl.ts with HTTPS-only + public-IP enforcement,
  provider allowlist, IPv6 rejection, and userinfo-in-URL blocking.
- Add lib/byoHeaders.ts — single source of truth for client-side BYO
  header construction (deduplicates app/page.tsx & app/play/page.tsx).
- config.ts: validate BYO endpoints via isPublicUrl(), cap header at
  2 KB, truncate apiKey/model strings, sanitize log output.
- fetchWithRetry: default redirect to "manual" to block 302-to-intranet.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(security): address Copilot review — trim endpoint, strip control chars, drop unused import

- safeEndpoint: trim whitespace before URL validation
- safeString: strip ASCII control characters to prevent header injection
- play/page.tsx: remove unused BYO_STORAGE_KEY import

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

2026-06-05 00:23:35 +08:00

chat.ts

feat(ai-client): multi-provider compat — native Anthropic/Google + URL tolerance

2026-06-04 17:09:05 +08:00

fetchWithRetry.ts

fix(security): harden BYO API header against SSRF and input abuse (#33 )

2026-06-05 00:23:35 +08:00

image.ts

feat(web,engine): portrait-orientation scene images for mobile full-bleed

2026-06-04 17:30:54 +08:00

index.ts

feat(web,engine): custom style — image upload, AI-extract prompt, painter ref