Ben Stull
79a447c77b
Two informational findings from the Session-0026 audit, both framework-internal defense-in-depth. No operator action: no migration, no schema/config/overlay change, no deployment-facing surface. - I3: guard the dead text/html branch in email_envelope.build_envelope. No send path passes body_html; the unused branch would emit HTML built from possibly-unescaped user content (C1 stored-XSS class in the mail channel). Passing body_html now raises NotImplementedError; the arg is kept for documented future symmetry, enabling HTML mail becomes a deliberate escape-then-unguard change. - I4: make turnstile.verify_token async. The sync httpx.post ran inside the async /auth/otc/request handler, blocking the event loop up to the 10s timeout on a slow CloudFlare call. It now awaits httpx.AsyncClient via a narrow _siteverify_post seam (tests patch the seam, not the shared AsyncClient). The sole caller (main.py) now awaits it. Tests: full backend suite 365 passed. Added a coroutine-contract unit test for verify_token and flipped the email_envelope HTML test to assert the guard. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
36 lines
905 B
JSON
36 lines
905 B
JSON
{
|
|
"name": "rfc-app-frontend",
|
|
"private": true,
|
|
"version": "0.28.0",
|
|
"type": "module",
|
|
"scripts": {
|
|
"dev": "vite",
|
|
"build": "vite build",
|
|
"preview": "vite preview"
|
|
},
|
|
"dependencies": {
|
|
"@amplitude/unified": "^1.1.9",
|
|
"@codemirror/commands": "^6.10.3",
|
|
"@codemirror/lang-markdown": "^6.5.0",
|
|
"@codemirror/language": "^6.12.3",
|
|
"@codemirror/state": "^6.6.0",
|
|
"@codemirror/view": "^6.43.0",
|
|
"@tiptap/extension-placeholder": "^3.5.0",
|
|
"@tiptap/pm": "^3.5.0",
|
|
"@tiptap/react": "^3.5.0",
|
|
"@tiptap/starter-kit": "^3.5.0",
|
|
"dompurify": "^3.2.4",
|
|
"marked": "^18.0.4",
|
|
"mermaid": "^11.15.0",
|
|
"react": "^19.2.6",
|
|
"react-dom": "^19.2.6",
|
|
"react-router-dom": "^7.2.0"
|
|
},
|
|
"devDependencies": {
|
|
"@types/react": "^19.2.14",
|
|
"@types/react-dom": "^19.2.3",
|
|
"@vitejs/plugin-react": "^6.0.1",
|
|
"vite": "^8.0.12"
|
|
}
|
|
}
|