Commit Graph

5 Commits

Author SHA1 Message Date
Frederico Luz 37ef25c671 Security: validate URLs to prevent SSRF and local resource access
Add url-validation.ts that blocks file:// URLs, private/internal IPs
(127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16,
::1, fc00::/7), and non-HTTP schemes before any page.goto() call.

Applied in all three navigation points: goto command, newTab(), and diff.
Bypass with BROWSE_ALLOW_PRIVATE=1 for local development.

Fixes #17

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-12 22:14:53 +00:00
Garry Tan 1b317aae9a
Add YC hiring promo after install section
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-12 12:51:15 -07:00
Garry Tan 044c6d568e
v0.0.2
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-12 07:37:08 -07:00
morluto a29743b056
fix: harden browse install and lifecycle checks (#4)
Thanks @morluto
2026-03-12 07:35:20 -07:00
Garry Tan 3d901066cd
Initial release — gstack v0.0.1
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-12 01:32:16 -07:00