Skip to content

v0.2.2

Choose a tag to compare

View all tags
@BlaiseMoses01 BlaiseMoses01 released this 03 Jul 16:31
· 55 commits to main since this release
v0.2.2
6ec566e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security

  • The broker now enforces an Origin allow-list at the WebSocket handshake: only the
    companion extension's chrome-extension:// origin and origin-less Node clients
    (the MCP bridge) may connect. Web-page origins are rejected with a 403, so
    arbitrary pages can no longer connect to the localhost port and drive playback
    (#18).
  • The extension validates wire-sourced sessionIds as UUIDs before using them as
    tab-map keys (closes a CodeQL remote-property-injection alert).
  • The smoke-test fake extension sanitizes logged wire values with JSON.stringify
    (closes a CodeQL log-injection alert).
Assets 3
Loading