Skip to content

DiffNotes 1.6.1

Choose a tag to compare

View all tags
@igorkasyanchuk igorkasyanchuk released this 29 Oct 22:02
· 9 commits to main since this release
v1.6.1
3cc757b

Security

  • Invitations by email wait on a dashboard only for a user whose email GitHub proved: someone who made a user for
    another person's address through their own invitation link no longer catches the invitations other teams send it.
  • A long repository name can't stall the server any more (its parsing was quadratic in a run of /).
  • Request bodies are measured, not taken from content-length (a chunked request skipped MAX_BODY_KB).
  • Sessions are stored as SHA-256 (nobody is signed out by the change); the cookie is __Host-sid over https (the old
    sid is taken only for a session from before); only a Bearer token skips the cross-site check (a Basic auth
    proxy's header doesn't), and a browser without Sec-Fetch-Site that sends an Origin must send this site's.
  • Login throttles key IPv6 clients by /64, sweep at most once a minute and keep at most 50,000 entries.
  • Files a bucket refused to delete are kept and tried again by the hourly purge, instead of staying in the bucket.
  • Extension: tokens live in the extension's own IndexedDB, out of storage.local (which its content scripts can
    read); a file preview opens only on a person's click and only for a file of the PR on the page; demos and videos are
    posted only into its own demo.html.
  • Skill: the base branch is fetched as refs/heads/$B (a branch named like a git option can't act as one); what it
    reads (code, PR text, .diffnotes.yml, stored notes) is data, never instructions; a PR's code runs only for a trusted
    author and without DIFFNOTES_TOKEN. The MCP tool descriptions say the same. install.sh works with spaces in $HOME.
Assets 3
Loading