ZhenYi/gitdataai
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
763d47dc45
gitdataai/libs/api
History
ZhenYi bdb5393835 fix: resolve 30+ bugs from security audit 
Critical:
- CORS: replace allow_any_origin + credentials with env-configured origins
- XSS: escape HTML before dangerouslySetInnerHTML in search results
- Path traversal: sanitize storage keys to reject ".." components
- Auth missing: add Session requirement to git init/open/is-repo endpoints
- Transaction: wrap issue cascade delete in DB transaction

High:
- Mutex poisoning: replace unwrap() with poison-recovering guards
- Drop tokio::spawn: use runtime handle or fallback thread for lock release
- Redis KEYS: replace with non-blocking SCAN for typing events
- SSH panic: handle missing stdin/stdout/stderr gracefully
- LFS auth: remove x-user-uid header injection vector, generate per-request tokens

Medium:
- Memory leak: remove Box::leak in provider normalization
- Race conditions: query closed count directly instead of subtraction
- Silent failures: add tracing::warn for AI tasks, room events, activity logs
- Frontend nav: sync activeRoomId when initialRoomId prop changes
- Duplicate nav: remove redundant setActiveRoom in delete handler
- Callback conflict: skip undefined values in updateCallbacks merge
- Stale closure: use wsClient state instead of wsClientRef.current in useMemo

Low:
- Captcha: validate captcha not empty before login submission
- Broadcast capacity: reduce from 100K to 1000
- Error handling: add try/catch for removeMember and updateMemberRole
- Loading state: show placeholder instead of null in RepositoryContextProvider
- WebSocket: add heartbeat ping and jitter to reconnect backoff
2026-04-27 10:57:23 +08:00
..
agent chore: API and frontend UI adjustments 2026-04-25 09:54:05 +08:00
auth feat(room): add category creation and drag-to-assign for channels 2026-04-19 16:44:31 +08:00
git fix: resolve 30+ bugs from security audit 2026-04-27 10:57:23 +08:00
issue chore: API and frontend UI adjustments 2026-04-25 09:54:05 +08:00
project fix(avatar): add upload API routes and fix URL path prefix 2026-04-25 23:19:22 +08:00
pull_request
room fix(room): fix two major memory leaks 2026-04-26 16:52:20 +08:00
search chore: API and frontend UI adjustments 2026-04-25 09:54:05 +08:00
user fix(avatar): add upload API routes and fix URL path prefix 2026-04-25 23:19:22 +08:00
workspace feat(backend): add workspace invitation list and slug-based accept APIs 2026-04-18 19:05:07 +08:00
build.rs feat(frontend): embed SPA assets into app binary at compile time 2026-04-17 12:04:34 +08:00
Cargo.toml feat: add sitemap index with static/users/projects/repos sub-sitemaps 2026-04-26 00:06:18 +08:00
dist.rs feat(api): pre-compress static assets with brotli and gzip 2026-04-25 20:09:09 +08:00
error.rs
gen_api.rs
lib.rs chore(api): remove entire admin module 2026-04-26 14:08:15 +08:00
openapi.rs chore(api): remove entire admin module 2026-04-26 14:08:15 +08:00
robots.rs feat: add sitemap index with static/users/projects/repos sub-sitemaps 2026-04-26 00:06:18 +08:00
route.rs chore(api): remove entire admin module 2026-04-26 14:08:15 +08:00
sidemap.rs feat: add sitemap index with static/users/projects/repos sub-sitemaps 2026-04-26 00:06:18 +08:00
skill.rs