gqxx408 3f29448030 fix(security): harden Tauri capabilities, OAuth callback, upload and XSS surfaces ...

- tauri.conf.json: replace csp:null with a restrictive CSP (blocks eval/inline scripts)
- capabilities: remove unused shell:allow-execute (RCE enabler) and sql:allow-execute
- capabilities: scope fs permissions to app/user directories instead of '**'
- oauth_command: per-session secret validation to block token injection
- useLogin: embed secret in OAuth redirectUri
- configuration: sanitize DB filename (path traversal) + SQLCipher key plumbing
- im_request_client: externalize hardcoded Basic-Auth secret via HULA_IM_BASIC_AUTH
- websocket/client: redact auth token from logs
- markdown_command: confine image/file paths within allowed roots
- upload_command: forbid absolute paths, confine to AppCache/AppData, https-only
- Bot.vue: sanitizeMarkdown safe-by-default; validate link schemes

2026-09-27 18:45:18 +08:00

..

android

fix(android): 🐛 add MODIFY_AUDIO_SETTINGS permission for audio control

2025-12-31 18:30:20 +08:00

apple

docs(docs): 📝 update readme

2026-01-23 19:11:14 +08:00

schemas

fix(security): harden Tauri capabilities, OAuth callback, upload and XSS surfaces

2026-09-27 18:45:18 +08:00