iptvnator

x15904151985/iptvnator

0 Fork 0

mirror of https://github.com/4gray/iptvnator.git synced 2026-10-09 01:16:15 -08:00

Files

T

History

4grayandClaude Fable 5 6b30e8b9e9 fix(mock): address CodeQL findings in the new portal auth code

Two genuine defects in the code this PR added:
- readBearerToken's /Bearer\s+(.*)$/ backtracks polynomially on
  "bearer" followed by a long run of spaces; require the token to start
  with a non-space character instead
- the /stalker proxy route read query params as strings without
  narrowing, so a repeated key (?url=a&url=b) arrives as an array and
  String.prototype.includes silently changes meaning

The remaining three alerts (missing rate limiting x2, sensitive data in
a GET query) are web-service hygiene rules aimed at internet-facing
services. The mock servers bind to localhost, serve fabricated data,
ship in no artifact, and deliberately mirror the real backend proxy's
token-in-query contract; a rate limiter would break the E2E suite that
hammers them. Exclude only those two apps from analysis via a documented
CodeQL config; every shipped path keeps full coverage.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-08-01 12:42:35 +02:00

build-and-make.yaml

fix(skills): align repository guidance with implementation (#1315 )

2026-07-31 08:00:59 +02:00

ci.yml

chore(deps): bump actions/setup-node from 4 to 7 (#1285 )

2026-07-28 08:13:00 +02:00

cleanup-pr-draft.yml

ci(release): make test draft releases traceable and self-cleaning (#1202 )

2026-07-19 07:59:53 +02:00

codeql-analysis.yml

fix(mock): address CodeQL findings in the new portal auth code