ulihhhhandClaude Opus 5.5 320a1d6bfd fix(cctv): harden the Catalonia catalog fetch and frame-link allowlist ...

Address review feedback on #595:

- Reject frame links carrying userinfo (user:pass@) in
  normalizeCataloniaImageUrl, so catalog data cannot inject credentials
  into the server-side frame request on an allowlisted host.
- Fetch cameres.xml over https (verified: same 200 body, no redirect),
  refuse redirects with the unread body released, and read the body
  through readResponseTextCapped with a 1 MiB CATALONIA_MAX_CATALOG_BYTES
  cap instead of an unbounded resp.text().
- Add regression tests for userinfo links on every allowed host, the
  refused redirect, and declared and streamed oversize bodies.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

2026-09-27 12:01:17 +02:00

..

providers

fix(cctv): harden the Catalonia catalog fetch and frame-link allowlist

2026-09-27 12:01:17 +02:00

standalone

docs: changelog entry for the macOS chmod fix (#694)

2026-09-24 22:01:56 -07:00