sencho

mirror of https://github.com/Studio-Saelix/sencho.git synced 2026-07-27 20:29:10 +00:00

Files

T

Anso 6ac02c792a fix(backend): use URL parser for registry scheme + template host check (#808 )

Two small hardenings flagged by CodeQL:

- routes/registries.ts: drop the redundant startsWith block-list and rely
  solely on URL parsing + protocol allow-list. The startsWith pass was
  unreachable defense (any non-http/https scheme already fails the
  protocol check below it) and was tripping js/incomplete-url-scheme-check.
- services/TemplateService.ts: replace the .includes('api.linuxserver.io')
  substring match with new URL(registryUrl).hostname comparison. The
  substring form would mis-classify a malicious admin-set URL like
  https://evil.example/api.linuxserver.io/... as the LSIO registry and
  apply the LSIO response parser to its payload. Hostname compare closes
  that.

Behavioral parity for the happy path: every previously-accepted URL still
parses; the LSIO branch still triggers when the hostname is exactly
api.linuxserver.io.

2026-04-27 11:02:10 -04:00

scripts

fix(fleet): resolve getSenchoVersion crash in Docker containers (#396 )

2026-04-06 00:44:36 -04:00

src

fix(backend): use URL parser for registry scheme + template host check (#808 )

2026-04-27 11:02:10 -04:00

.npmrc

chore(deps): upgrade major dependencies (ESLint 10, recharts 3, TS 6, Vite 8) (#130 )

2026-03-25 00:03:08 -04:00

eslint.config.mjs

feat: RBAC, atomic deployments, fleet backups, and licensing (Pro) (#185 )