Repository navigation
Keys only answers its own page
Keys listens on 127.0.0.1, but that does not make it private: any web page you visit can
make your browser call it. Before this release a hostile page could read the live note feed
and press Panic or start an update; DNS rebinding could reach the whole API.
Now every request must carry a loopback Host, and any Origin the browser sends must match
it — on the websocket too. Anything else gets a 403. There is no per-note cost.
Names from the network are checked
Preset ids, saved-loop names and soundfont names become file names. A ..\ in any of them
could reach outside its folder. They are now validated (find_asset, preset save/delete,
loop load).
Score import checks the declared size before reading the body and converts off the event
loop, so a large file can no longer stall the UI feed.
Adds tools/security_check.py (43 assertions). Not fixed here: a crafted .mid can still
stall the importer, and /api/data reports the data folder path.
SHA-256 of the zip: 67d8ae87b91bdb6efbf1fab79105ccf754456e68c2115dec516399910c2c1b1e