Skip to content

Fix/security and quality improvements #2555

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
plato23 wants to merge 4 commits into
base: main
Choose a base branch
from
Open

Fix/security and quality improvements #2555

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
ead4bcf
ci: add daily upstream sync workflow
plato23 Mar 25, 2026
88dc071
Merge remote-tracking branch 'upstream/main'
plato23 Mar 30, 2026
67fb912
fix: harden SSRF guard, null safety, type safety, and scroll perf
plato23 Mar 30, 2026
7801c8d
Merge branch 'main' into fix/security-and-quality-improvements
plato23 Mar 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 17 additions & 0 deletions .github/workflows/sync-upstream.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
name: Sync upstream

on:
schedule:
- cron: '0 6 * * *' # daily at 6 AM UTC
workflow_dispatch: # manual trigger from Actions tab

jobs:
sync:
runs-on: ubuntu-latest
steps:
- name: Sync fork via GitHub API
run: |
gh api repos/${{ github.repository }}/merge-upstream \
-f branch=main
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
2 changes: 1 addition & 1 deletion scripts/notification-relay.cjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,7 +75,7 @@ async function deactivateChannel(userId, channelType) {
// ── Private IP guard ─────────────────────────────────────────────────────────

function isPrivateIP(ip) {
return /^(10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.|127\.|::1|fc|fd)/.test(ip);
return /^(0\.|10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.|169\.254\.|127\.|::1$|fe80:|fc|fd)/.test(ip);
Copy link
Copy Markdown

@greptile-apps greptile-apps bot Mar 30, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 IPv6 patterns unreachable via dns.resolve4

The IPv6 patterns added (::1$, fe80:, fc, fd) can never match in the current code path because dns.resolve4() resolves only A records and always returns IPv4 address strings. If a webhook host resolves exclusively via AAAA (IPv6), dns.resolve4 will throw a ENODATA/ENOTFOUND error, which is caught and the request is safely blocked — so there is no vulnerability, but the IPv6 guards in this function are currently dead code.

If IPv6 SSRF protection is desirable in future, consider also calling dns.resolve6() and checking those results through isPrivateIP. For now the defensive patterns don't cause any harm.

}

// ── Delivery: Telegram ────────────────────────────────────────────────────────
Expand Down
6 changes: 5 additions & 1 deletion src/components/ChatAnalystPanel.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,6 +67,7 @@ export class ChatAnalystPanel extends Panel {
private domainFocus = 'all';
private streamAbort: AbortController | null = null;
private isStreaming = false;
private scrollRafId = 0;
private messagesEl!: HTMLElement;
private inputEl: HTMLTextAreaElement | null = null;

Expand Down Expand Up @@ -265,7 +266,9 @@ export class ChatAnalystPanel extends Panel {
}

private scrollToBottom(): void {
requestAnimationFrame(() => {
if (this.scrollRafId) return;
this.scrollRafId = requestAnimationFrame(() => {
this.scrollRafId = 0;
this.messagesEl.scrollTop = this.messagesEl.scrollHeight;
});
}
Expand Down Expand Up @@ -448,6 +451,7 @@ export class ChatAnalystPanel extends Panel {
override destroy(): void {
this.streamAbort?.abort();
this.streamAbort = null;
cancelAnimationFrame(this.scrollRafId);
super.destroy();
}
}
2 changes: 1 addition & 1 deletion src/services/cross-module-integration.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -771,7 +771,7 @@ function identifyTopRisks(
}

const leadSanctions = sanctions?.countries[0];
if (leadSanctions && (sanctions.newEntryCount > 0 || leadSanctions.entryCount >= 25)) {
if (leadSanctions && sanctions && (sanctions.newEntryCount > 0 || leadSanctions.entryCount >= 25)) {
const label = sanctions.newEntryCount > 0 ? 'Sanctions burst' : 'Sanctions pressure';
risks.push(`${label}: ${leadSanctions.countryName} (${leadSanctions.entryCount}, +${leadSanctions.newEntryCount} new)`);
}
Expand Down
2 changes: 1 addition & 1 deletion src/services/market-watchlist.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ function coerceEntry(v: unknown): MarketWatchlistEntry | null {
return { symbol: sym };
}
if (v && typeof v === 'object') {
const obj = v as any;
const obj = v as Record<string, unknown>;
const sym = normalizeSymbol(String(obj.symbol || ''));
if (!sym) return null;
const name = normalizeName(typeof obj.name === 'string' ? obj.name : undefined);
Expand Down