mirror of https://github.com/garrytan/gstack.git
de4832ba1a
serve.ts injected url.origin into a single-quoted JS string in the response body. A local request with a crafted Host header (e.g. Host: "evil'-alert(1)-'x") would break out of the string and execute JS in the 127.0.0.1:<port> origin opened by the design board. Low severity — bound to localhost, requires a local attacker — but no reason not to escape. Fix: JSON.stringify(url.origin) produces a properly quoted, escaped JS string literal in one call. Also includes Prettier reformatting (single→double quotes, trailing commas, line wrapping) applied by the repo's PostToolUse formatter hook. Security change is the one line in the HTML injection; everything else is whitespace/style. |
||
|---|---|---|
| .. | ||
| auth.ts | ||
| brief.ts | ||
| check.ts | ||
| cli.ts | ||
| commands.ts | ||
| compare.ts | ||
| design-to-code.ts | ||
| diff.ts | ||
| evolve.ts | ||
| gallery.ts | ||
| generate.ts | ||
| iterate.ts | ||
| memory.ts | ||
| serve.ts | ||
| session.ts | ||
| variants.ts | ||