jaredandClaude Opus 5 f3119e3dc2 fix(security): validate avatar-decoration slugs from remote profiles ...

The MSC4133 io.lotus.avatar_decoration value was interpolated into the
CDN URL verbatim, letting a room member steer the path/query of a request
every viewer's browser makes. Accept only slugs present in the catalog;
anything else is treated as no decoration. Unit-tested.

Fixes #64

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA

2026-09-12 14:48:35 -04:00

..

app

fix(security): validate avatar-decoration slugs from remote profiles

2026-09-12 14:48:35 -04:00

client

fix: low-tail correctness — thread notifs, call audio, OIDC expiry

2026-07-19 02:47:27 -04:00

types

feat(rooms): Room Widgets (MSC1236 im.vector.modular.widgets)

2026-07-03 13:27:23 -04:00

util

fix: ESLint errors, stale disable comments, bundle splitting

2026-05-22 19:52:23 -04:00

colors.css.ts

feat(themes): 5 new dark theme presets — Cyberpunk/Ocean/Blood Red/Matrix/Midnight (P5-2)

2026-06-28 16:47:50 -04:00

config.css.ts

fix font-weight in dark theme with unsupported fonts (#1964)

2024-09-22 22:31:32 +10:00

ext.d.ts

chore: upgrade i18next 26, prettier 3, fontsource-variable, domhandler 6, lint-staged 17

2026-05-21 23:30:50 -04:00

index.css

fix(mobile): touch targets, keyboard viewport, PageNav overflow, modal fullscreen

2026-06-18 13:34:40 -04:00

index.tsx

fix(url-preview): thumbnail fallback + quiet timeline console spam

2026-07-09 23:47:19 -04:00

lotus-boot.ts

ui: visual polish — animations, icons, and interaction improvements

2026-05-23 23:52:58 -04:00

lotus-terminal.css.ts

ui: voice recorder pulse + TDS styling, wire mic denied error to input bar

2026-05-24 00:30:12 -04:00

sw-session.ts

Post session info to service worker instead of asking from sw (#2605)

2026-02-14 17:11:36 +11:00

sw.ts

perf(audit): emojibase lazy-split, SW precache, Prism subset, lazy images

2026-07-02 00:19:16 -04:00