Repository navigation

fix(security): 收紧请求资源上限并加固凭据处理 - #804

Open

DeliciousBuding wants to merge 22 commits into

james-6-23:mainfrom

DeliciousBuding:fix/security-p0

Open

fix(security): 收紧请求资源上限并加固凭据处理#804
DeliciousBuding wants to merge 22 commits into
james-6-23:mainfrom
DeliciousBuding:fix/security-p0

Commits on Oct 18, 2026
- fix(security): charge request memory by actual reads
  DeliciousBuding
  committed
  e9c0183
- fix(proxy): bound parse-cache memory and oversized input arrays
  DeliciousBuding
  committed
  3e60464
- fix(images): cap external input images and trim the 202 receipt
  DeliciousBuding
  committed
  0482f9e
- fix(proxy): cap concurrent downstream WebSocket connections
  DeliciousBuding
  committed
  1e84e02
- fix(auth): keep self-service OAuth callbacks in pending review
  DeliciousBuding
  committed
  587bcf7
- fix(security): redact proxy credentials and TLS-wrap https proxies
  DeliciousBuding
  committed
  a7fda91
- chore(deploy): fix log workdir and validate build versions
  DeliciousBuding
  committed
  946d357
- test(security): use locked budget snapshot in prepay test
  DeliciousBuding
  committed
  9554e25
- fix: address security review feedback
  DeliciousBuding
  committed
  f984972
- fix: address remaining review feedback
  DeliciousBuding
  committed
  5ff88cd
- fix: close quota burst and upstream memory gaps
  DeliciousBuding
  committed
  11a9a36
- fix: address admission review feedback
  DeliciousBuding
  committed
  27dab23
- test(admin): assert no-store on authenticated responses
  DeliciousBuding
  committed
  3d0a136
- test(ui): wait for concurrency badge before measuring layout
  DeliciousBuding
  committed
  92da4c2
- fix(oauth): escape callback page and reject replayed sessions
  DeliciousBuding
  committed
  8a21315
- docs: document API key admission counting and request bounds
  DeliciousBuding
  committed
  c3994e3
- fix(security): close audit bypasses and bound upstream reads
  DeliciousBuding
  committed
  b4c71d6
- docs: clarify upstream read-budget coverage
  
  DeliciousBuding
  and
  Codex
  committed
  8951bf5
- fix(security): finish OAuth session and admission guards
  
  DeliciousBuding
  and
  Codex
  committed
  8d847c8
- test(admin): isolate OAuth exchange counts and cover saturated admission
  
  DeliciousBuding
  and
  Codex
  committed
  7b8b9d0
- fix(admin): request fresh authorization after consumed session fails
  
  DeliciousBuding
  and
  Codex
  committed
  c4435b4
- fix(admin): save pending account review metadata atomically
  
  DeliciousBuding
  and
  Codex
  committed
  61d09aa

Commits

Commits on Oct 18, 2026