mirror of
https://github.com/supermemoryai/supermemory.git
synced 2026-08-27 17:32:24 +00:00
3b0fc9c959
Cherry-picks #1579 and #1580 from @Sravanjangam (security audit #1578), plus improvements on top. - `/api/og`, `/api/onboarding/extract-content` and `/api/onboarding/research` now verify the session against the auth backend; the middleware only checked that a cookie was present, so a forged cookie reached handlers that spend metered Exa/xAI quota. - Bounds those routes: 2MB cap on fetched HTML, max 10 http(s) URLs per request, name/email length limits and a 60s timeout on the LLM call. - De-duplicates URLs before calling Exa, and collapses whitespace in `name`/`email` so a newline can't forge extra prompt lines. Both adapted from @SEPURI-SAI-KRISHNA's #1528 and #1530. - Deletes the unused, unauthenticated `account-status` route. Verified locally: pre-fix `/api/og` returned 200 for a forged cookie, post-fix it returns 401. Five duplicate URLs collapse to two before reaching Exa, and a newline-laden `name` arrives as a single prompt line. Supersedes #1528 and #1530. |
||
|---|---|---|
| .. | ||
| (app) | ||
| (auth)/login | ||
| api | ||
| auth | ||
| oauth/consent | ||
| org/invite/[invitationId] | ||
| ref | ||
| slack/link | ||
| upgrade-mcp | ||
| global-error.tsx | ||
| icon.png | ||
| layout.tsx | ||
| manifest.ts | ||
| not-found.tsx | ||
| opengraph-image.png | ||
