a2nr
/
elemes
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
elemes/frontend
History
a2nr bb8ca50650 fix(upload): review — CSP SVG, boundary 5 MiB, regression guard 502/413 
Hasil review pasca-fix upload asset:

Keamanan:
- Mitigasi stored-XSS via SVG (route /assets/* publik, same-origin):
  CSP 'default-src none; sandbox' saat serve SVG — di backend
  (send_assets) DAN di proxy SvelteKit (proxy hanya meneruskan
  content-type/set-cookie, jadi CSP backend tak sampai ke browser).
- Deteksi 413 proxy kini ber-test status code + pesan.

Testing:
- Regression guard: error jaringan biasa tetap 502, bukan 413.
- 413 via status code saja (tanpa regex pesan) tetap 413.
- Boundary 5 MiB: file TEPAT 5 MiB lolos; 5 MiB+1 ditolak (cabang
  len(raw) — SVG dipakai karena dikecualikan validasi PIL).
- CSP: SVG dapat header, raster tidak.
- E2E script (verify_asset_upload.py) memakai file asli
  mr-edu/assets/ilustrasi_beban.jpeg + test 413 terintegrasi.

Reuseability:
- Komentar silang-referensi _MAX_ASSET_BYTES (sumber) dengan pesan 413
  proxy dan BODY_SIZE_LIMIT compose.
 		2026-10-03 08:06:29 +07:00
..
src fix(upload): review — CSP SVG, boundary 5 MiB, regression guard 502/413 2026-10-03 08:06:29 +07:00
static feat(code-runner): implement client-side C and Python execution with offline mirror and COEP iframe embedding 2026-09-13 10:14:51 +07:00
tests/e2e feat(code-runner): implement client-side C and Python execution with offline mirror and COEP iframe embedding 2026-09-13 10:14:51 +07:00
.dockerignore
…
Dockerfile fix(markdown): sanitasi DOMPurify, perbaikan parser flashcard & kompatibilitas SSR Node 20 2026-08-28 05:24:44 +07:00
node-polyfill.cjs feat(code-runner): implement client-side C and Python execution with offline mirror and COEP iframe embedding 2026-09-13 10:14:51 +07:00
package-lock.json chore: tambah fflate untuk unzip client-side 2026-10-01 12:06:24 +07:00
package.json chore: tambah fflate untuk unzip client-side 2026-10-01 12:06:24 +07:00
svelte.config.js
…
tsconfig.json
…
vite.config.ts feat(playground): implement synchronous interactive input for client-side C and Python 2026-09-14 04:13:08 +07:00
vitest.config.ts fix(review): address code review findings for dev to master merge 2026-09-06 18:08:58 +07:00