J3vb 485040be32 security: validate avatar URLs on server and client ...

- Add validateAvatarURL helper enforcing https:// scheme, non-empty host, and 512-char max length
- Add rate limiting (10/min) to PATCH /api/v1/users/me profile update endpoint
- Guard avatar rendering in DmSidebar, DmProfileSidebar, and UserProfilePopup with isSafeUrl check to prevent unsafe URL injection in the UI

2026-04-03 08:10:26 +02:00

..

public

feat: voice/video polish — refactor, AudioWorklet VAD, bug fixes, UX improvements

2026-03-29 00:51:54 +01:00

src

security: validate avatar URLs on server and client

2026-04-03 08:10:26 +02:00

src-tauri

feat: auto-grant microphone permission in WebView2 via --use-fake-ui-for-media-stream

2026-04-02 23:41:01 +02:00

tests

chore: remove soundboard feature entirely

2026-04-02 17:00:27 +02:00

.gitignore

update gitignore

2026-03-19 19:22:42 +01:00

.oxlintrc.json

fix: replace mutating sort/reverse with toSorted/toReversed (ES2023)

2026-04-01 15:44:06 +02:00

.prettierignore

chore: update tooling, CI workflows, and dependencies

2026-04-01 11:40:55 +02:00

eslint.config.js

chore: ESLint config, 61 lint fixes across 22 client files, CLAUDE.md update

2026-03-29 19:40:11 +02:00

index.html

feat: server enhancements, client test selectors, and UI polish

2026-03-17 02:56:19 +01:00

knip.json

chore: update tooling, CI workflows, and dependencies

2026-04-01 11:40:55 +02:00

package-lock.json

chore: add dev tooling — Stryker, gremlins, k6, toxiproxy, Coraza WAF, Zod

2026-04-01 13:49:06 +02:00

package.json

chore: add dev tooling — Stryker, gremlins, k6, toxiproxy, Coraza WAF, Zod

2026-04-01 13:49:06 +02:00

playwright.config.native.ts

test: fix 10 test quality bugs (BUG-058–067) and resolve 115 TS type errors

2026-03-30 16:35:02 +02:00

playwright.config.prod.ts

feat: native file downloads, upload size fix, native E2E tests

2026-03-18 17:10:16 +01:00

playwright.config.ts

feat: native file downloads, upload size fix, native E2E tests

2026-03-18 17:10:16 +01:00

stryker.config.mjs

chore: add dev tooling — Stryker, gremlins, k6, toxiproxy, Coraza WAF, Zod

2026-04-01 13:49:06 +02:00

tsconfig.build.json

test: fix 10 test quality bugs (BUG-058–067) and resolve 115 TS type errors

2026-03-30 16:35:02 +02:00

tsconfig.json

feat: add stream preview, video grid track lifecycle, and build cleanup

2026-04-01 17:07:02 +02:00

vite.config.ts

feat: server enhancements, client test selectors, and UI polish

2026-03-17 02:56:19 +01:00

vitest.config.browser.ts

chore: update tooling, CI workflows, and dependencies

2026-04-01 11:40:55 +02:00

vitest.config.ts

fix: CI failures — correct chat delete test expectations and coverage threshold

2026-03-28 18:55:11 +01:00