Claude ba074f566d fix(security): validate base_url / console_gateway_url as real http(s) URLs ...

The config file accepted any value that merely starts with "http" (so even
"httpfoo://evil" passed) for base_url and console_gateway_url — origins the
client sends the Bearer token to. Validate them with `new URL()` and an
http:/https: protocol check instead, rejecting malformed values. Valid http(s)
URLs (including custom proxies and local http) are unaffected.

https://claude.ai/code/session_017ZGQCjwNQF5Pz96gLUnnG1

2026-05-29 12:44:50 +00:00

..

cli

fix(security): require script/js code to be a literal (block untrusted-code RCE)

2026-05-29 12:44:48 +00:00

core

fix(security): validate base_url / console_gateway_url as real http(s) URLs

2026-05-29 12:44:50 +00:00