Skip to content

Veil v1.2.5

Choose a tag to compare

View all tags
@github-actions github-actions released this 04 Apr 04:20
v1.2.5
8e91c89

Security Hardening

  • Added Content-Security-Policy (script-src 'self'; object-src 'none') to the extension manifest, blocking eval, inline scripts, and object embeds in all extension pages.
  • Fixed an XSS vector in textToHtmlPreserveLayout where code-block and inline-code content bypassed HTML escaping before innerHTML insertion in contentEditable elements.
  • Added a ReDoS guard (1,000-match cap) to the custom-pattern regex loop in the background service worker, preventing catastrophic backtracking from user-defined patterns.
  • Replaced inline onerror event handlers in popup and options HTML with CSP-safe JavaScript listeners.
  • Removed raw PII entries from the server-side anonymization request log; only entries_count is logged now.
  • Added length limits on custom-pattern fields: label ≤ 64, regex ≤ 500, replacement ≤ 200 characters.
  • Added HTTPS-scheme validation on release-link URLs sourced from the GitHub API before assigning them to anchor href attributes.
  • Added a sender-tab guard on the background message handler, rejecting messages that don't originate from a content script in a real tab.
  • Replaced realistic-looking dummy API keys in test fixtures with clearly fake placeholders to avoid git secret-scanner false positives.

Installer Improvements

  • Windows install is now one-command: powershell -ExecutionPolicy Bypass -File install.ps1 --extension-id <ID> or $env:VEIL_EXTENSION_ID='<ID>'; irm .../install.ps1 | iex.
  • Windows uninstall is now one-command: powershell -ExecutionPolicy Bypass -File uninstall.ps1 or irm .../uninstall.ps1 | iex.
  • Improved uninstall messaging to confirm removal of server, venv, models, and all cached data.

Popup and Onboarding Polish

  • Reworked the popup onboarding flow into a consistent Material 3 purple surface, removing the leftover amber/gold treatment and tightening the popup-sized layout.
  • Fixed the first-use mask hint so it appears after onboarding is dismissed instead of being silently consumed while the onboarding overlay is still covering the popup.
  • Updated release-state messaging so Veil no longer shows a prominent delayed-check warning when GitHub is temporarily unavailable but the installed extension and local server bundle already match locally.
  • Fixed popup status subtitle flickering between server status and "Not active on this page" when server is online.

Redaction UX

  • Cleaned up the popup/settings redaction key so it shows only currently active redactions instead of long-lived response-restore aliases and partial-name mappings.
  • Improved redaction key layout so long anonymized values wrap cleanly instead of blowing out the dropdown panel.
  • Corrected live popup/settings stats so detected counts all active detections on the page while protected continues to reflect the redacted subset.

Test and Fixture Hygiene

  • Replaced production-looking fixture secrets in the shared regex smoke corpus with clearly synthetic placeholders while preserving detector coverage.
  • Refreshed the regex smoke demo and shared fixture references for the v1.2.5 release.
Assets 9
Loading