Patrick Buckley caf449e048 fix: address code scanning alerts — URL sanitization, workflow harden… (#298) ...

* fix: address code scanning alerts — URL sanitization, workflow hardening, XSS

- CI workflow: add top-level permissions (contents: read)
- Docker publish: gate on head_repository == self to block fork-based pwn
- URL checks: replace substring matching with proper hostname parsing
  (eval.py, model_registry.py, console/server.py)
- renderer.js: allowlist URL schemes (http/https) for images and links
- app.js: escape backslashes before quotes in CSS selector construction

* fix: break CodeQL taint chain — normalize image URL via URL constructor

* fix: address review — scheme-less URL handling, protocol-relative rejection, data:image allowlist

- Normalize scheme-less base URLs before hostname parsing (eval, model_registry,
  console/server) so api.openai.com without https:// still matches
- Reject protocol-relative URLs (//host) in image and link allowlists
- Allow data:image/ URIs for inline MCP resource images
- Tighten image source to https:// only (no relative paths)

* fix: route data: URIs through URL constructor to break CodeQL taint chain

2026-04-04 16:52:46 -07:00

..

workflows

fix: address code scanning alerts — URL sanitization, workflow harden… (#298)

2026-04-04 16:52:46 -07:00

renovate.json

feat: render rich media embeds for MCP tool results (#292)

2026-04-04 14:47:25 -07:00