4grayandClaude Opus 5.5 a48d0b913f fix(sources): keep fragment and nested URL secrets out of source names ...

Greptile bot (PR review, P1 security): an unnamed import of
https://host.test/list.m3u#api_key=secret123 stored list.m3u#api_key=…
as its title. isUrlDerivedName only knew names ending in a query, and
sourceSecrets only read the top-level query, so the row and the toolbar
showed the secret while the displayed URL hid it.

A name that ends the URL with a query or a fragment is now URL-derived,
and shows the host. The secrets a typed name is checked against now
include sensitive fragment parameters and, as stripUrlCredentials cleans
them, the credentials of URLs and parameter lists nested in parameters
(nested account names included).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-13 20:27:24 +02:00

..

import/feature

fix(ui): one focus ring colour everywhere via the shared mixin (#1882)

2026-10-11 10:40:08 +02:00

m3u/feature-player

fix(m3u): keep groups hidden in Manage groups after a restart (#1894) (#1907)

2026-10-12 23:06:39 +02:00

shared

fix(sources): keep fragment and nested URL secrets out of source names

2026-10-13 20:27:24 +02:00