mirror of https://github.com/garrytan/gstack.git
c0d85f7c0e
filterPersistableCookies trusted expires as a finite number and matched internal-network domains case-sensitively. A cookie with expires=NaN or Infinity slipped past the `=== -1` session check (NaN <= nowSec is false), and an uppercase `LOCALHOST` / `Foo.INTERNAL` bypassed the internal-domain block. Add a `Number.isFinite` guard and a shared `normalizeCookieDomain` that lower-cases before the internal-domain comparison. Allowlist matching already lower-cases internally, so behavior there is unchanged. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| bin | ||
| scripts | ||
| src | ||
| test | ||
| PLAN-snapshot-dropdown-interactive.md | ||
| SKILL.md | ||
| SKILL.md.tmpl | ||