clawbot cb68554484 Refuse an origin with a * inside at startup (closes #61) ...

access_control_allow_origin accepted values such as https://* or
https://*example.com, which the CORS middleware reads as a pattern that
lets other sites read responses. Any value that contains * and is not
exactly * now aborts startup naming the key, its variable and the value.

Model: opus-5-5

2026-09-28 19:51:14 +00:00

..

blocked_networks_internal_test.go

feat: blocked_networks config and extended SSRF ranges (closes #67)

2026-09-22 00:43:27 +02:00

cache_max_bytes_internal_test.go

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

cachesize.go

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

config_internal_test.go

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

config_validation_internal_test.go

Test that an origin with a * inside aborts startup (closes #61)

2026-09-28 19:51:14 +00:00

config.go

Refuse an origin with a * inside at startup (closes #61)

2026-09-28 19:51:14 +00:00

env_internal_test.go

Test four README settings pixa does not have yet (closes #61)

2026-09-28 19:51:14 +00:00

trusted_proxies_internal_test.go

Resolve real client IP behind trusted proxies (closes #94)

2026-09-22 10:25:41 +02:00