jpmschweitzer/odysseus
1
0
Fork 0
mirror of https://github.com/pewdiepie-archdaemon/odysseus.git synced 2026-10-19 05:12:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): harden browser security boundaries

Browse Source 
Reject unsafe metric ledger keys, keep email HTML inspection inert, and construct gallery thumbnails structurally. Add adversarial browser regressions for the remaining CodeQL security boundaries.
This commit is contained in:
Alexandre Teixeira
2026-10-05 23:48:14 +01:00
parent 0d97651686
commit 232249eb09
4 changed files with 505 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
static/js/chatRenderer.js
+4 -1
View File
@@ -1392,10 +1392,13 @@ export function recordSessionMetricsCost(metrics, sessionId, selectedEndpointUrl
const sid = sessionId || (
window.sessionModule && window.sessionModule.getCurrentSessionId()
);
if (!sid || cost === null) return cost;
if (typeof sid !== 'string' || !sid || cost === null) return cost;
const runId = typeof metrics._costRecordId === 'string'
? metrics._costRecordId.trim()
: '';
// Never resolve ledger entries through Object.prototype or its constructor.
if (['__proto__', 'prototype', 'constructor'].includes(sid)
|| ['__proto__', 'prototype', 'constructor'].includes(runId)) return cost;
if ((metrics._costRecorded || metrics._costRecordPending) && !runId) return cost;
// Recorded is only set once the write actually runs; pending covers the
// window while the write waits on the cross-tab lock, so a replay in that