Sebastion
f80dec2a42
fix(browser-management): restrict handleChangeUrl to http(s) schemes
...
The recording browser worker exposes an `input:url` socket event which
forwarded the client-supplied URL directly to `page.goto(url)` in
`handleChangeUrl`. Because Playwright runs on the server, any recording
client could coerce the shared worker into loading `file:///etc/passwd`,
`chrome://`, `about:`, `data:`, `javascript:` URIs, or arbitrary internal
HTTP endpoints. The response then becomes accessible to subsequent scrape
steps and is exfiltrated as run output.
Parse the incoming URL with the WHATWG URL API and reject anything whose
protocol is not `http:` or `https:` before generating the workflow pair
and before invoking `page.goto`. Malformed URLs (parser throws), relative
paths, protocol-relative URLs and opaque schemes are all rejected. The
rejection reuses the existing `emitBrowserPageError` broadcast so the
client sees a friendly message instead of a silent no-op.
CWE-20 (Improper Input Validation).
2026-07-03 21:44:25 +01:00
Karishma Shukla
6674965830
Merge pull request #1133 from getmaxun/clean-up
...
chore: cleanup
2026-07-03 18:35:42 +05:30
amhsirak
99df599074
chore: remove unused import
2026-07-03 18:34:16 +05:30
amhsirak
bafa055d9c
chore: remove unused import
2026-07-03 18:33:58 +05:30
amhsirak
5d97acccac
chore: remove unused import
2026-07-03 18:33:49 +05:30
amhsirak
2a9b00931e
chore: remove unused import
2026-07-03 18:32:15 +05:30
amhsirak
2ff07934ea
chore: remove unused import
2026-07-03 18:31:22 +05:30
amhsirak
7a61721315
chore: remove unused import
2026-07-03 18:31:07 +05:30
amhsirak
f211351e67
chore: remove unused import
2026-07-03 18:30:59 +05:30
amhsirak
03afbe9865
chore: remove unused import
2026-07-03 18:28:25 +05:30
amhsirak
1625523891
chore: remove unused import
2026-07-03 18:28:14 +05:30
amhsirak
412f7fa622
chore: remove unused import
2026-07-03 18:26:50 +05:30
Karishma Shukla
6c496e6ce4
chore: sponsors
2026-07-02 19:54:35 +05:30
Karishma Shukla
ccd35477e3
fix: close tr
2026-07-02 13:02:32 +05:30
Karishma Shukla
7b9aa5d642
chore: add new sponsor
2026-07-02 12:54:26 +05:30
Rohit
ca458fed8a
Merge pull request #1127 from getmaxun/multi-stage
...
fix: multi stage build docker
2026-06-25 16:56:47 +05:30
Rohit Rajan
8ec16bf502
fix: add multi stage build
2026-06-25 16:47:16 +05:30
Rohit
42f97deab1
Merge pull request #1125 from getmaxun/pre-release-43
...
chore: pre-release v0.0.43
2026-06-24 22:50:04 +05:30
Rohit Rajan
d18dee467e
fix: code duplication
2026-06-24 22:42:54 +05:30
amhsirak
8e43923299
chore: release v0.0.43
2026-06-24 22:26:22 +05:30
amhsirak
49915b7f75
chore: release v0.0.43
2026-06-24 22:26:09 +05:30
amhsirak
78477ca8d0
chore: release v0.0.43
2026-06-24 22:25:53 +05:30
amhsirak
d316fcd9bc
chore: use core v0.0.36
2026-06-24 22:25:34 +05:30
amhsirak
9a0a84d9c0
chore: use core v0.0.36
2026-06-24 22:24:52 +05:30
amhsirak
c61df61acd
chore: use core v0.0.36
2026-06-24 22:24:26 +05:30
amhsirak
eda52a5d49
chore: core v0.0.36
2026-06-24 22:22:26 +05:30
Rohit
cdff05b86b
Merge pull request #1124 from getmaxun/sel-wait
...
fix: rm list fallback
2026-06-24 22:21:23 +05:30
Rohit Rajan
ac23aeb0b7
fix: rm list fallback
2026-06-24 22:20:05 +05:30
Karishma Shukla
990af9476c
Merge pull request #1123 from getmaxun/sel-wait
...
fix: add selector waiting mechanism
2026-06-24 22:19:16 +05:30
Rohit Rajan
c02573254c
fix: add selector waiting mechanism
2026-06-24 22:17:56 +05:30
Karishma Shukla
c739dcbf5c
Merge pull request #1122 from getmaxun/optim-imgs
...
fix: reduce docker images size
2026-06-24 22:11:22 +05:30
Karishma Shukla
29b70f801a
Merge pull request #1121 from getmaxun/misc-nav-ui
...
fix(ui): match capture actions with recorder theme
2026-06-24 22:10:08 +05:30
Karishma Shukla
b5a185d4c4
Merge pull request #1119 from getmaxun/extract-fixes
...
fix: extract engine reliability, accuracy enhancement
2026-06-24 22:09:46 +05:30
Karishma Shukla
40d2145926
Merge pull request #1118 from getmaxun/scrape-fixes
...
fix: md conversion reliability, llm extraction accuracy
2026-06-24 22:07:50 +05:30
Rohit
67c17673cb
Merge branch 'develop' into scrape-fixes
2026-06-24 22:03:48 +05:30
Karishma Shukla
689772fc92
Merge pull request #1117 from getmaxun/multi-site
...
feat: add support for multi url llm extraction
2026-06-24 22:00:01 +05:30
Rohit
3c40f8a693
Merge branch 'develop' into multi-site
2026-06-24 21:58:36 +05:30
Karishma Shukla
665261c3be
Merge pull request #1116 from getmaxun/squery-clean
...
fix: clean smart query data display
2026-06-24 21:53:08 +05:30
Karishma Shukla
40f400e786
Merge pull request #1115 from getmaxun/chrome-error
...
fix: chrome web data network error display
2026-06-24 21:52:05 +05:30
Karishma Shukla
38e2f67022
Merge pull request #1114 from getmaxun/browser-fix
...
fix: add maxun browser image
2026-06-24 21:50:31 +05:30
Karishma Shukla
b28eb2245b
Merge pull request #1113 from getmaxun/llm-rob-create
...
fix: display llm robot create on reload or tab switch
2026-06-24 21:46:41 +05:30
Karishma Shukla
6e05e84dd0
Merge pull request #1111 from getmaxun/esbuild-chore
...
chore(deps): upgrade `esbuild` to latest version
2026-06-24 21:46:12 +05:30
Karishma Shukla
fd3f01e045
Merge pull request #1102 from Osamaali313/fix/minio-public-url
...
fix(storage): honor MINIO_PUBLIC_URL for browser-facing object URLs
2026-06-24 21:45:53 +05:30
Rohit Rajan
9b7e11fabb
fix: reduce docker images size
2026-06-24 20:58:33 +05:30
amhsirak
8ffd410d5f
fix: use red for getScreenshot discard
2026-06-23 16:52:57 +05:30
amhsirak
95d68d3926
fix: use red for getText discard
2026-06-23 16:47:29 +05:30
amhsirak
45e3961a73
fix: match back getList with recorder theme
2026-06-23 16:29:29 +05:30
Karishma Shukla
0e17580c8d
Merge pull request #1120 from getmaxun/misc-nav-ui
...
fix: misc ui
2026-06-23 16:15:51 +05:30
amhsirak
6791e9e4ef
fix: adjust logo to name
2026-06-23 15:58:37 +05:30
amhsirak
d992d83d6f
fix: set font size to 1.2em
2026-06-23 15:53:58 +05:30
Sebastion