7 Commits

Include renames

Author	SHA1	Message	Date
lockbitchat	366f080128	release: v4.8.9 security hardening patch ... - upgrade DOMPurify to patched release (fixes high-severity XSS GHSA-87xg-pxx2-7hvx) - upgrade esbuild build dependency; npm audit now reports 0 vulnerabilities - stop tracking config/ice-servers.js (TURN credentials); add example template - production logger no longer prints error context or info/debug output - bump version to 4.8.9 across header, manifest, README, init message - update SECURITY.md supported-release table to v4.8.x	2026-06-15 15:08:03 -04:00
lockbitchat	333c4b87b5	fix: improve sanitization to prevent XSS ... - Now the sanitization function protects against: - Nested script tags: <scrip<script>alert("XSS")</script>t> - HTML comments containing scripts: <!-- <script>alert("XSS")</script> --> - Multiple overlapping tags: <script><script>alert("XSS")</script></script> - Attributes in closing tags: </script foo="bar"> - Complex nested structures combining different tags - All known XSS vectors	2025-10-19 23:55:41 -04:00
lockbitchat	5096a09811	fix: improve sanitization to prevent XSS ... - Now the sanitization function protects against: - Nested script tags: <scrip<script>alert("XSS")</script>t> - HTML comments containing scripts: <!-- <script>alert("XSS")</script> --> - Multiple overlapping tags: <script><script>alert("XSS")</script></script> - Attributes in closing tags: </script foo="bar"> - Complex nested structures combining different tags - All known XSS vectors	2025-10-19 23:54:26 -04:00
lockbitchat	d2830b9c46	Optimize JSON and QR codes ... - Replaced original JSON with minimized binary format (gzip + base64). - Adjusted rendering and QR code generation for compatibility. - Reduced payload size for improved efficiency.	2025-10-05 06:21:14 -04:00
lockbitchat	7902359c48	feat(qr-exchange): improved QR code exchange system ... - Updated connection flow between users via QR codes - Added manual switching option in QR code generator - Increased number of QR codes for better readability	2025-09-27 19:07:17 -04:00
lockbitchat	34094956b7	feat(core): update session, security system and QR exchange ... - Removed session creation and Lightning payment logic - Refactored security system: * no more restrictions * all systems enabled on session creation - Improved QR code exchange for mobile devices	2025-09-23 20:01:02 -04:00
lockbitchat	0f8399ec88	feat(security,ui): self-host React deps, Tailwind, fonts; strict CSP; local QR; better selection state ... Replace CDN React/ReactDOM/Babel with local libs; remove Babel and inline scripts Build Tailwind locally, add safelist; switch to assets/tailwind.css Self-host Font Awesome and Inter (CSS + woff2); remove external font CDNs Implement strict CSP (no unsafe-inline/eval; scripts/styles/fonts from self) Extract inline handlers; move PWA scripts to external files Add local QR code generation (qrcode lib) and remove api.qrserver.com Improve SessionTypeSelector visual selection (highlighted background and ring) Keep PWA working with service worker and offline assets Refs: CSP hardening, offline-first, no external dependencies	2025-09-08 16:04:58 -04:00