H1 — stored XSS via v-html / innerHTML of unsanitized LLM/agent/interview/report
content: add DOMPurify; both renderMarkdown() now return DOMPurify.sanitize(html)
(Step4Report.vue, Step5Interaction.vue), and the formatAnswer innerHTML sink is
wrapped in DOMPurify.sanitize. All 8 HTML-injection sinks now sanitized; markdown
rendering preserved (DOMPurify secure defaults keep the md-* tags/classes).
H4 — wildcard CORS: CORS origins now Config.ALLOWED_ORIGINS (comma-separated env,
default localhost:3000) instead of '*'.
H5 — request bodies written to disk in cleartext: logger file level now follows
FLASK_DEBUG (INFO in prod), so the before_request body-debug log is suppressed in
production. (traceback-in-response across 53 handlers deferred to a separate refactor.)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Closes the four CRITICAL findings from the 2026-06-13 review.
C1 — Werkzeug debug RCE / dev server in prod:
- FLASK_DEBUG defaults False (kills interactive-debugger network RCE)
- production runs gunicorn (-w 1 --threads 8) via `npm run start`; Dockerfile
builds the frontend and serves it with `vite preview` (host 0.0.0.0); gunicorn
+ uv.lock updated
- Config.validate() now runs inside create_app() so the gunicorn path enforces
SECRET_KEY (prod) / API_KEY / LLM / ZEP at boot
C2 — zero auth on all /api/* routes:
- before_request API-key guard (X-API-Key / Bearer), constant-time bytes compare,
/health + OPTIONS exempt
- AUTH_ENABLED fail-closed parse (only explicit false/0/no/off disables)
- frontend axios injects X-API-Key from build-time VITE_API_KEY, wired through
docker compose build-arg -> Dockerfile ARG -> vite build (+ frontend/.env.example)
C3 — denial-of-wallet (no cost ceiling; OASIS_DEFAULT_MAX_ROUNDS was dead config):
- OASIS_DEFAULT_MAX_ROUNDS now applied when max_rounds omitted (default 150, covers
the 144-round demo); hard ceilings OASIS_MAX_ROUNDS_CAP / OASIS_MAX_AGENTS_CAP;
runner always forwards the clamped rounds to the subprocess
C4 — no simulation deadline; env.step could wedge forever:
- every env.step (initial / round-loop / interview) wrapped in asyncio.wait_for
(OASIS_ROUND_TIMEOUT_SEC) across all 3 run scripts; per-loop total-deadline
(OASIS_RUN_TIMEOUT_SEC); gather(return_exceptions=True) + single-platform
try/except so one platform's failure can't skip env.close
New env vars documented in .env.example + README security section.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Add sans-serif font for English left-pane (status, workflow sections)
- Shorten English workflow step descriptions
- Reduce English report title font-size from 36px to 28px
- Use sans-serif font for English titles, descriptions and navbar
- Shorten English hero text to avoid overflow
- Fix :global() scoped CSS issue that was setting root font-size to 3.5rem
- Use separate unscoped style block for html[lang] selectors
Background:
- With many nodes, D3 force simulation tick callback updates all nodes/edges/labels every frame
- Original implementation called simulation.restart() in drag start event on mousedown
- Even after simulation converged, clicking a node to view details would restart simulation, causing lag
Solution:
- Distinguish between "click" and "drag" using 3px movement threshold
- On drag start: only record initial position, do not restart simulation
- On drag event: detect movement exceeding threshold before marking as actual drag and restarting simulation
- Pure click operations no longer trigger simulation restart, keeping graph static
Bug fix:
- Fixed issue where nodes became undraggable after initial optimization
- Cause: incorrectly used if(!event.active) check in drag event
- event.active equals 1 during drag event, causing restart() to never execute
- Removed that condition, using custom _isDragging flag to control logic instead
- Changed the title for the environment configuration status icon to "环境搭建" for clarity.
- Added a creation time display in the project detail modal for better context.
- Introduced a divider for the playback section to improve visual separation.
- Enhanced navigation buttons with step indicators for clearer user progression.
- Added a hint for playback limitations to inform users about simulation requirements.
- Updated CSS styles for new elements and improved overall modal aesthetics.
- Updated card header to include status icons indicating project availability for different functionalities.
- Added a visual indicator for additional files when more than three are present.
- Improved card footer layout by grouping date and time, and enhancing progress display with status colors.
- Introduced new CSS styles for status icons and improved overall card aesthetics.
- Wrapped modal content in a Transition component for smoother animations.
- Adjusted modal dimensions and padding for improved layout and user experience.
- Updated styles for modal elements, including background colors, borders, and hover effects.
- Enhanced visual feedback for buttons and file items within the modal.
- Implemented a modal to display detailed information about selected projects, including simulation requirements and associated files.
- Added navigation buttons within the modal for quick access to project, simulation, and report pages.
- Enhanced user experience by allowing users to view project details without leaving the main interface.
- Added route watcher to reload history data when navigating back to the homepage.
- Improved card positioning by adjusting vertical spacing for better visual alignment.
- Initialized IntersectionObserver to manage card visibility more effectively.
- Ensured data loading occurs after DOM rendering for smoother user experience.
- Added conditional rendering for the tech grid background and cards container based on project availability.
- Simplified the empty state display logic when no projects are present.
- Introduced a new CSS class to adjust layout when there are no projects, enhancing visual consistency.
- Changed card header to display round progress instead of status.
- Updated card footer to show formatted time instead of rounds.
- Introduced new methods for calculating progress class and formatting time.
- Adjusted styles for progress display and refined layout for better responsiveness.
- Introduced a pending state to track the target expansion state during animations.
- Improved debounce handling to ensure smoother transitions and prevent rapid state changes.
- Updated logic to check for new pending states after animations complete, enhancing responsiveness and stability.
- Introduced a computed property to adjust the container's minimum height based on the number of cards and expansion state.
- Removed static min-height styles to enhance responsiveness and visual consistency.
- Introduced a debounce mechanism to prevent rapid state changes during card expansion and collapse.
- Added an animation lock to avoid conflicts during transitions.
- Adjusted Intersection Observer thresholds and rootMargin for smoother detection and stability.
- Cleaned up resources on component unmounting to prevent memory leaks.
- Updated simulation history retrieval to read project details directly from the Simulation file.
- Improved simulation configuration handling by reading simulation requirements from JSON.
- Added project file listing to the simulation history, displaying up to three associated files.
- Refined card layout in HistoryDatabase.vue to accommodate new file display features and improved responsiveness.
- Removed dynamic offset calculation for the CTA button, fixing its position.
- Updated card layout logic to ensure proper stacking and alignment.
- Increased minimum heights for both collapsed and expanded states to enhance visual consistency.
- Added section numbering to the report sections for better clarity.
- Unified scroll behavior to reset to the top upon task completion, while scrolling to the bottom for ongoing tasks.
- Updated CSS styles for section numbers to improve visual consistency.
- Updated response handling to prioritize replies from Reddit over Twitter and ensure compatibility with both object and array formats.
- Refactored survey result processing to convert response data into a structured array, maintaining clarity and consistency in agent responses.
- Improved error handling and logging for better debugging and user feedback.
Yo-LRK
ghostubborn
666ghj