Kevin Veen-BirkenbachandClaude Opus 5.5
ba97f7cc2e
Deutschlandfunk stayed silent: its signed URL answers 302 to f111.rndfnk.com, an origin the signed media-src never listed, so the browser blocked the redirected load and reported only the station's own URL in securitypolicyviolation. The hub now resolves each https stream's redirect chain server side when a settings save adds or changes it and stores the extra origins as the stream's via list. media-src lists them next to the signed origins. A CDN host of three or more labels widens to its siblings (*.rndfnk.com); an IP, a two-label host and a name under a country code's generic second level stay exact. Hardening: - Only the signed URL itself may lie at a non-global address; every redirect hop dials a global address only, checked on the address actually dialed (NAT64 and IPv4-compatible IPv6 count by the embedded IPv4 address). - A resolve answers within three socket timeouts even for a server that drips its headers; a late probe goes on in a daemon thread and a url still in flight is not probed twice. - A failed resolution stores via null and retries on a save ten minutes later; the radio page says so instead of blaming the CSP. - A save whose settings changed while it was resolved fails instead of overwriting them (compare and set under the settings lock). - A new stream URL at an already signed origin takes the passkey too. - Settings written before via existed load as via [] and never dial. Residuals: - The passkey proof is spent before the resolve, so a save racing another one fails and the operator signs again. - A save that hits a due retry blocks up to twelve seconds and may reload the page. - A page loaded before the upgrade throws on the missing via until it reloads. - A private multi-tenant suffix such as github.io still widens. - getaddrinfo has no timeout; it runs inside the daemon thread. Operator step after install: remove Deutschlandfunk in Radio, Sender bearbeiten, save, add it again and save with the passkey. 🎯 Fix: 92 % 💥 Break: 4 % 💸 Cost: 100 % ⏱️ Time: – 🛡️ Security: 100 % 🏆 Score: 88 🚦 Gate: ✅ 90/5, cost and time <= 100, security 100 % Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
61 lines
3.2 KiB
JavaScript
61 lines
3.2 KiB
JavaScript
function stored(key, fallback) {
|
|
try {
|
|
const text = window.localStorage.getItem(key);
|
|
return text === null ? fallback : JSON.parse(text);
|
|
} catch {
|
|
return fallback;
|
|
}
|
|
}
|
|
|
|
function keep(key, value) {
|
|
try {
|
|
window.localStorage.setItem(key, JSON.stringify(value));
|
|
return true;
|
|
} catch {
|
|
return false;
|
|
}
|
|
}
|
|
|
|
function validViews(value) {
|
|
const names = new Set(KINDS.map(([id]) => id));
|
|
if (!Array.isArray(value)) {
|
|
return [];
|
|
}
|
|
return value.filter((view) => view && typeof view.name === "string" && view.name && Array.isArray(view.kinds) && view.kinds.length && view.kinds.every((name) => names.has(name)))
|
|
.map((view) => ({name: view.name.slice(0, 60), kinds: view.kinds, waiting: view.waiting === true, q: typeof view.q === "string" ? view.q : "", agent: typeof view.agent === "string" ? view.agent : ""}));
|
|
}
|
|
|
|
let state = JSON.parse(document.getElementById("state").textContent);
|
|
const KINDS = Object.entries(state.kinds);
|
|
const ui = {screen: "stream", views: {agents: "orbit", artifacts: "tree", tasks: "list"}, preset: DAY, from: null, to: null, asOf: null, playing: false, busy: false, offline: false, agent: null, order: null, draft: "", node: null, cursor: 0, selected: new Set(), snoozed: false, review: null, file: 0};
|
|
const filter = {view: "fuer-dich", saved: "", kinds: new Set(state.views["fuer-dich"].kinds), waiting: true, q: "", agent: "", session: "", sub: "", parts: new Set(PARTS.map(([id]) => id))};
|
|
const stream = {key: null, events: [], entries: [], last: 0, sessions: {}, busy: false, again: false, dom: null, error: ""};
|
|
const tree = {data: null, model: null, busy: false, q: "", open: new Set(), dom: null};
|
|
const palette = {items: [], index: 0, input: null, list: null, plan: null, box: null};
|
|
const known = {inbox: null, alarms: null, radio: null, batches: new Set()};
|
|
const motion = {current: new Map(), from: new Map(), target: new Map(), start: 0, duration: 0, frame: 0, asOf: undefined};
|
|
const drawn = {screen: "", sig: ""};
|
|
const files = new Map();
|
|
const pageMedia = new Set(state.media);
|
|
const sky = {canvas: document.getElementById("sky"), stars: Ambience.stars(320, 7), mode: "", frame: 0};
|
|
const music = {gain: null, filter: null, drone: [], timer: 0, tension: 0, ducked: 0};
|
|
const radio = {element: null, url: "", level: 0, timer: 0, playing: false, waiting: false, index: -1, pick: null, sig: "", state: "", short: "", note: "", told: null};
|
|
const speech = {pending: [], busy: false, warned: 0, current: null, source: null};
|
|
const mic = {recorder: null, held: false, busy: false, timer: 0};
|
|
const space = {
|
|
views: {graph: {...state.settings.space.graph}, sky: {...state.settings.space.sky}}, glides: {graph: null, sky: null}, edits: 0, saved: 0, timer: 0, look: false, compass: null,
|
|
};
|
|
let userViews = validViews(stored(STORE.views, stored("kvb-hub.views", [])));
|
|
let settings = state.settings;
|
|
let settingsSig = JSON.stringify(settings);
|
|
let drawerDom = null;
|
|
let timeDom = null;
|
|
let graphDom = null;
|
|
let reviewDom = null;
|
|
let inboxDom = null;
|
|
let replay = 0;
|
|
let positions = new Map();
|
|
let inboxSig = "";
|
|
let audio = null;
|
|
let searchTimer = 0;
|