Mplan/opencloud
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(security): 修复客户端认证与地图渲染漏洞 #5

Merged
Mplan merged 2 commits from fix/security-audit into main 2026-07-23 02:41:43 +08:00
Conversation 0 Commits 2 Files Changed 7
+161 -111
Mplan commented 2026-07-23 02:39:49 +08:00
Owner
Copy Link
Copy Source

安全修复

  • 修复地图标记与悬浮卡片中的存储型 XSS
  • 限制登录后的重定向目标为当前站点
  • 提前清除邮箱确认和密码重置 URL 中的令牌
  • 将 Vite 升级到 8.0.16，修复已公开的高危漏洞
  • 收紧 Referrer Policy 并增加 HSTS

验证

  • npm audit --audit-level=low：0 个漏洞
  • npm run build
  • 6 组正常与恶意重定向用例
  • 危险 DOM API 残留检查
## 安全修复 - 修复地图标记与悬浮卡片中的存储型 XSS - 限制登录后的重定向目标为当前站点 - 提前清除邮箱确认和密码重置 URL 中的令牌 - 将 Vite 升级到 8.0.16，修复已公开的高危漏洞 - 收紧 Referrer Policy 并增加 HSTS ## 验证 - `npm audit --audit-level=low`：0 个漏洞 - `npm run build` - 6 组正常与恶意重定向用例 - 危险 DOM API 残留检查
Mplan added 1 commit 2026-07-23 02:39:49 +08:00
fix(security): harden client auth and map rendering 578d995001
Mplan added 1 commit 2026-07-23 02:41:20 +08:00
Merge branch 'main' into fix/security-audit 8fa65574af
Mplan merged commit 02399ffae8 into main 2026-07-23 02:41:43 +08:00
Mplan deleted branch fix/security-audit 2026-07-23 02:41:43 +08:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
Mplan (Mplan)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Mplan/opencloud#5