Fix the open bug and security issues #40

Merged

tiagoagueda merged 1 commit from security-and-bugs into main

2026-10-18 21:07:19 +00:00

tiagoagueda commented

2026-10-18 18:28:07 +00:00

Owner

Fixes every open issue labelled bug or security except #29.

Closes #28
Closes #32
Closes #33
Closes #34
Closes #35
Closes #36
Closes #37
Closes #38
Closes #39

#33 An address with a user name or password is refused (noCredentialsInAddress); the log header names the host only.
#34 Plain http only to localhost, 127.0.0.1 and [::1]; a .local instance needs https. Hint, PRIVACY.md and test agree. This is a behaviour change for anyone on http://….local.
#35 Every request is made with redirect: "error".
#36 onInstance() checks every server-supplied review or listing address (stored on sending, and again when drawn); another origin leaves no link.
#37 The description is cut to 160 000 characters before it is read, and the tag splitter is one budgeted pass instead of a backtracking regular expression. A test feeds it 1 MB of <a .
#38 Test refuses a token holding scopes besides captures (tokenTooWide).
#39 The build's languageTag and direction come last in shipped().
#32 web-ext 10.8.0; CI runs scripts/audit.mjs. npm audit is not clean: node-forge (via web-ext's Android debugging) has no fixed release, so that one advisory is allowed by id, with a review date, and anything else high fails CI.
#28 A refused host-permission prompt is said in the popup, the review window and the captures page (permissionRefused); the capture still waits. Unit-tested in askAndKeep; the popup handlers themselves have no DOM test, and the Firefox 140 hand check was not done.

New sentences are in English only; Weblate fills the rest.

Not done: #29 (try the extension in a real Chromium and Firefox 140) needs a person at a browser.

src/lib/api.js is shared with postulo-thunderbird through shared.json; it needs a shared:sync there.

🤖 Generated with Claude Code

Fixes every open issue labelled `bug` or `security` except #29. Closes #28 Closes #32 Closes #33 Closes #34 Closes #35 Closes #36 Closes #37 Closes #38 Closes #39 - **#33** An address with a user name or password is refused (`noCredentialsInAddress`); the log header names the host only. - **#34** Plain http only to `localhost`, `127.0.0.1` and `[::1]`; a `.local` instance needs https. Hint, `PRIVACY.md` and test agree. This is a behaviour change for anyone on `http://….local`. - **#35** Every request is made with `redirect: "error"`. - **#36** `onInstance()` checks every server-supplied review or listing address (stored on sending, and again when drawn); another origin leaves no link. - **#37** The description is cut to 160 000 characters before it is read, and the tag splitter is one budgeted pass instead of a backtracking regular expression. A test feeds it 1 MB of `<a `. - **#38** Test refuses a token holding scopes besides `captures` (`tokenTooWide`). - **#39** The build's `languageTag` and `direction` come last in `shipped()`. - **#32** web-ext 10.8.0; CI runs `scripts/audit.mjs`. `npm audit` is not clean: node-forge (via web-ext's Android debugging) has no fixed release, so that one advisory is allowed by id, with a review date, and anything else high fails CI. - **#28** A refused host-permission prompt is said in the popup, the review window and the captures page (`permissionRefused`); the capture still waits. Unit-tested in `askAndKeep`; the popup handlers themselves have no DOM test, and the Firefox 140 hand check was not done. New sentences are in English only; Weblate fills the rest. **Not done: #29** (try the extension in a real Chromium and Firefox 140) needs a person at a browser. `src/lib/api.js` is shared with postulo-thunderbird through `shared.json`; it needs a `shared:sync` there. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

tiagoagueda added 1 commit

2026-10-18 18:28:07 +00:00

Security review fixes and the refused permission prompt

CI / check (pull_request) Successful in 31s

Details

1784db9b59

SEC2-076 an address with credentials is refused and the log names the host only;
SEC2-077 plain http only to loopback; SEC2-078 redirects are refused on every call;
SEC2-079 addresses the server supplies are opened only on the instance's origin;
SEC2-080 the page reader no longer takes quadratic time on a hostile description;
SEC2-081 Test refuses a token wider than captures; SEC2-084 the build's language and
direction cannot be overridden; SEC2-051 web-ext 10.8 and an audit step in CI; #28 a
refused host permission is said.

Refs #28 #32 #33 #34 #35 #36 #37 #38 #39

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>