mirror of
https://github.com/jhd3197/ServerKit.git
synced 2026-11-02 18:17:11 +09:00
Juan DenisandClaude Opus 5
8000faad0b
Reasoning about a redirect validator is how they ship broken, so this was driven by a probe that asks the URL parser directly: for ~50 candidate strings, does `new URL(candidate, base)` leave the origin, and does sanitizeRedirect agree? Zero leaks before or after -- the origin property was never broken. What the probe did surface was three ways to be wrong that are not origin escapes: 1. Dot segments were accepted. `/..//evil.com` normalizes to `//evil.com`, which stays same-origin only because it is resolved against a base; assigned to window.location.href it leaves the site. Rather than audit every present and future consumer of the stored value, the gadget is now refused outright -- plain and percent-encoded, in any position. A dot inside a segment name (/files/.env) is untouched. 2. Auth routes were matched as exact strings, so /login/ and, worse, /login/callback/<provider> got through -- the latter re-runs the SSO callback with no code and lands the user on an error page right after a successful login. Now a prefix match on a "/" boundary, case-insensitive, which still leaves /logins and /login-help as valid destinations. 3. No expiry. A destination parked early in a tab session fired on any later login in that tab: park an install link, abandon it, log in normally half an hour later, get taken somewhere you had forgotten about. Now stamped and good for 30 minutes -- long enough for a password manager, a TOTP prompt, or an SSO round trip that includes signing up at the provider. Also a 2048-char cap, and consume now refuses a missing, non-numeric or future timestamp rather than trusting it: rememberRedirect is the only writer, so anything else did not come from this module. Tests go 9 -> 19, and now cover the remember/consume round trip (single use, expiry, tampered storage, storage unavailable) against a fake sessionStorage so the whole module still runs under plain node. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
React Dashboard Template
A modern React dashboard application boilerplate built with Vite, featuring routing, charts, and a sidebar layout for building data-driven web interfaces.
Features
- React 18 with functional components and hooks
- Vite for fast development and building
- React Router for client-side routing
- Recharts for data visualization
- Lucide React for icons
- ESLint for code linting
- Responsive sidebar layout
- Dashboard page with sample components
Getting Started
Prerequisites
- Node.js 16+ and npm
Installation
- Clone or download this template
- Install dependencies:
npm install
Development
Start the development server:
npm run dev
The app will be available at http://localhost:41921.
Building for Production
Build the app for deployment:
npm run build
The output will be in the dist/ directory.
Preview Production Build
npm run preview
Project Structure
src/
├── App.jsx # Main app with routing
├── main.jsx # Entry point
├── index.css # Global styles
├── components/
│ └── Sidebar.jsx # Navigation sidebar
├── layouts/
│ └── DashboardLayout.jsx # Main layout wrapper
└── pages/
└── Dashboard.jsx # Main dashboard page
Customization
- Modify components in
src/components/ - Add new pages in
src/pages/ - Update routes in
App.jsx - Customize styles in
index.cssor component files
Environment Variables
Create a .env file in the root for environment variables:
VITE_API_URL=https://api.example.com
Access them in code via import.meta.env.VITE_API_URL.
Contributing
See the documentation files for AI agent permissions and guidelines.