mirror of
https://github.com/FluxaMedia/fluxa-desktop.git
synced 2026-08-06 16:59:20 +00:00
d99cb5c6f9
- OAuth: generate and validate a state param across the Trakt/MAL/Simkl deep-link flow to close a login-CSRF gap (code was exchanged with no check that it came from a flow this app actually started). - Add net_guard: resolves the host of any addon-supplied URL and refuses to fetch loopback/private/link-local/CGNAT addresses, applied to http_fetch_text, artwork prefetch, and offline downloads. Drop the now-unused localhost/ws CSP allowances. - Encrypt storage_read/storage_write at rest (AES-256-GCM, key in a 0600-permissioned file) instead of plaintext JSON, with transparent fallback for existing unencrypted files so upgrading doesn't lose data. - Replace get_nuvio_config (handed the Supabase anon key straight to JS) with a nuvio_request proxy command -- Rust attaches the key and makes the call itself, so it never exists in webview-reachable memory. |
||
|---|---|---|
| .. | ||
| assets/material-symbols | ||
| capabilities | ||
| icons | ||
| patches/tauri-runtime-wry-2.11.2 | ||
| plugins/tauri-plugin-libmpv | ||
| src | ||
| build.rs | ||
| Cargo.lock | ||
| Cargo.toml | ||
| fetch-libmpv.sh | ||
| tauri.conf.json | ||