github-featured / chainlit--chainlit

发布

0 发布 168 Git 标签

RSS 订阅源
  • 2.9.4 ffc3cce648
    比较

    security: add sanitization for custom thread element update (#2737)

    frostbyte_neo 发布于 2025-12-24 07:35:26 +00:00 | 91 次提交 在此版本后已推送到 main

    Summary by cubic

    Sanitizes custom thread element updates and deletes to block unsafe
    fields (path/URL) and prevent arbitrary file reads. Adds tests to verify
    access control and request forgery protections.

    • Bug Fixes
    • Server: sanitize custom element payloads and build elements from safe
      fields only in update/delete handlers.
    • Tests: added Cypress specs to confirm injected file paths/URLs aren’t
      readable and forged requests don’t expose element data.
    • Test fixtures: updated data layer to persist elements and normalize
      suspicious URLs.
    • Utilities: added a WebSocket listener helper to capture Socket.IO
      “element” events in tests.

    Written for commit 9d6f99aa78e078324c050f799b5558627eea943f.
    Summary will update automatically on new commits.

    下载附件