風雪
2f3856704b
- H-1: Subscription URIs / sub_tokens were sent to the third-party api.qrserver.com via GET query, leaking SS passwords / VMess UUIDs / sub_tokens to an untrusted service. Replace with a new QRCode.tsx component using the 'qrcode' npm package (pure client-side canvas). Remove the QR <img> from the backend subpage defaultHTML too. - H-2: Add isTokenExpired() helper parsing JWT exp; useAuth now proactively logs out when the token has already expired instead of waiting for a 401. Full httpOnly-cookie migration documented as a follow-up (requires backend API changes). - MED-2: axios ^1.7.9 -> ^1.8.4 (CVE-2025-27152). - MED-3: Add CSP, X-Frame-Options: DENY, X-Content-Type-Options, referrer=same-origin meta tags to index.html. - MED-6: Remove leftover console.log(r.data) in Settings.tsx. - MED-7: Commit package-lock.json for reproducible builds (npm ci). - LOW-1: Simplify keep_token to !values.bot_token (consistent with Cluster.tsx). - LOW-2: Remove dead share Modal + state in Users.tsx. - LOW-6: Unify formatBytes in utils/format.ts (4 duplicates removed). - LOW-7: ChangePassword min length 6 -> 8. fix(frontend): local QR generation, JWT expiry, CSP, axios CVE - H-1: Subscription URIs / sub_tokens were sent to the third-party api.qrserver.com via GET query, leaking SS passwords / VMess UUIDs / sub_tokens to an untrusted service. Replace with a new QRCode.tsx component using the 'qrcode' npm package (pure client-side canvas). Remove the QR <img> from the backend subpage defaultHTML too. - H-2: Add isTokenExpired() helper parsing JWT exp; useAuth now proactively logs out when the token has already expired instead of waiting for a 401. Full httpOnly-cookie migration documented as a follow-up (requires backend API changes). - MED-2: axios ^1.7.9 -> ^1.8.4 (CVE-2025-27152). - MED-3: Add CSP, X-Frame-Options: DENY, X-Content-Type-Options, referrer=same-origin meta tags to index.html. - MED-6: Remove leftover console.log(r.data) in Settings.tsx. - MED-7: Commit package-lock.json for reproducible builds (npm ci). - LOW-1: Simplify keep_token to !values.bot_token (consistent with Cluster.tsx). - LOW-2: Remove dead share Modal + state in Users.tsx. - LOW-6: Unify formatBytes in utils/format.ts (4 duplicates removed). - LOW-7: ChangePassword min length 6 -> 8. fix(frontend): local QR generation, JWT expiry, CSP, axios CVE - H-1: Subscription URIs / sub_tokens were sent to the third-party api.qrserver.com via GET query, leaking SS passwords / VMess UUIDs / sub_tokens to an untrusted service. Replace with a new QRCode.tsx component using the 'qrcode' npm package (pure client-side canvas). Remove the QR <img> from the backend subpage defaultHTML too. - H-2: Add isTokenExpired() helper parsing JWT exp; useAuth now proactively logs out when the token has already expired instead of waiting for a 401. Full httpOnly-cookie migration documented as a follow-up (requires backend API changes). - MED-2: axios ^1.7.9 -> ^1.8.4 (CVE-2025-27152). - MED-3: Add CSP, X-Frame-Options: DENY, X-Content-Type-Options, referrer=same-origin meta tags to index.html. - MED-6: Remove leftover console.log(r.data) in Settings.tsx. - MED-7: Commit package-lock.json for reproducible builds (npm ci). - LOW-1: Simplify keep_token to !values.bot_token (consistent with Cluster.tsx). - LOW-2: Remove dead share Modal + state in Users.tsx. - LOW-6: Unify formatBytes in utils/format.ts (4 duplicates removed). - LOW-7: ChangePassword min length 6 -> 8. fix(frontend): local QR generation, JWT expiry, CSP, axios CVE - H-1: Subscription URIs / sub_tokens were sent to the third-party api.qrserver.com via GET query, leaking SS passwords / VMess UUIDs / sub_tokens to an untrusted service. Replace with a new QRCode.tsx component using the 'qrcode' npm package (pure client-side canvas). Remove the QR <img> from the backend subpage defaultHTML too. - H-2: Add isTokenExpired() helper parsing JWT exp; useAuth now proactively logs out when the token has already expired instead of waiting for a 401. Full httpOnly-cookie migration documented as a follow-up (requires backend API changes). - MED-2: axios ^1.7.9 -> ^1.8.4 (CVE-2025-27152). - MED-3: Add CSP, X-Frame-Options: DENY, X-Content-Type-Options, referrer=same-origin meta tags to index.html. - MED-6: Remove leftover console.log(r.data) in Settings.tsx. - MED-7: Commit package-lock.json for reproducible builds (npm ci). - LOW-1: Simplify keep_token to !values.bot_token (consistent with Cluster.tsx). - LOW-2: Remove dead share Modal + state in Users.tsx. - LOW-6: Unify formatBytes in utils/format.ts (4 duplicates removed). - LOW-7: ChangePassword min length 6 -> 8. fix(frontend): local QR generation, JWT expiry, CSP, axios CVE - H-1: Subscription URIs / sub_tokens were sent to the third-party api.qrserver.com via GET query, leaking SS passwords / VMess UUIDs / sub_tokens to an untrusted service. Replace with a new QRCode.tsx component using the 'qrcode' npm package (pure client-side canvas). Remove the QR <img> from the backend subpage defaultHTML too. - H-2: Add isTokenExpired() helper parsing JWT exp; useAuth now proactively logs out when the token has already expired instead of waiting for a 401. Full httpOnly-cookie migration documented as a follow-up (requires backend API changes). - MED-2: axios ^1.7.9 -> ^1.8.4 (CVE-2025-27152). - MED-3: Add CSP, X-Frame-Options: DENY, X-Content-Type-Options, referrer=same-origin meta tags to index.html. - MED-6: Remove leftover console.log(r.data) in Settings.tsx. - MED-7: Commit package-lock.json for reproducible builds (npm ci). - LOW-1: Simplify keep_token to !values.bot_token (consistent with Cluster.tsx). - LOW-2: Remove dead share Modal + state in Users.tsx. - LOW-6: Unify formatBytes in utils/format.ts (4 duplicates removed). - LOW-7: ChangePassword min length 6 -> 8. fix(frontend): local QR generation, JWT expiry, CSP, axios CVE - H-1: Subscription URIs / sub_tokens were sent to the third-party api.qrserver.com via GET query, leaking SS passwords / VMess UUIDs / sub_tokens to an untrusted service. Replace with a new QRCode.tsx component using the 'qrcode' npm package (pure client-side canvas). Remove the QR <img> from the backend subpage defaultHTML too. - H-2: Add isTokenExpired() helper parsing JWT exp; useAuth now proactively logs out when the token has already expired instead of waiting for a 401. Full httpOnly-cookie migration documented as a follow-up (requires backend API changes). - MED-2: axios ^1.7.9 -> ^1.8.4 (CVE-2025-27152). - MED-3: Add CSP, X-Frame-Options: DENY, X-Content-Type-Options, referrer=same-origin meta tags to index.html. - MED-6: Remove leftover console.log(r.data) in Settings.tsx. - MED-7: Commit package-lock.json for reproducible builds (npm ci). - LOW-1: Simplify keep_token to !values.bot_token (consistent with Cluster.tsx). - LOW-2: Remove dead share Modal + state in Users.tsx. - LOW-6: Unify formatBytes in utils/format.ts (4 duplicates removed). - LOW-7: ChangePassword min length 6 -> 8. fix(frontend): local QR generation, JWT expiry, CSP, axios CVE - H-1: Subscription URIs / sub_tokens were sent to the third-party api.qrserver.com via GET query, leaking SS passwords / VMess UUIDs / sub_tokens to an untrusted service. Replace with a new QRCode.tsx component using the 'qrcode' npm package (pure client-side canvas). Remove the QR <img> from the backend subpage defaultHTML too. - H-2: Add isTokenExpired() helper parsing JWT exp; useAuth now proactively logs out when the token has already expired instead of waiting for a 401. Full httpOnly-cookie migration documented as a follow-up (requires backend API changes). - MED-2: axios ^1.7.9 -> ^1.8.4 (CVE-2025-27152). - MED-3: Add CSP, X-Frame-Options: DENY, X-Content-Type-Options, referrer=same-origin meta tags to index.html. - MED-6: Remove leftover console.log(r.data) in Settings.tsx. - MED-7: Commit package-lock.json for reproducible builds (npm ci). - LOW-1: Simplify keep_token to !values.bot_token (consistent with Cluster.tsx). - LOW-2: Remove dead share Modal + state in Users.tsx. - LOW-6: Unify formatBytes in utils/format.ts (4 duplicates removed). - LOW-7: ChangePassword min length 6 -> 8. fix(frontend): local QR generation, JWT expiry, CSP, axios CVE - H-1: Subscription URIs / sub_tokens were sent to the third-party api.qrserver.com via GET query, leaking SS passwords / VMess UUIDs / sub_tokens to an untrusted service. Replace with a new QRCode.tsx component using the 'qrcode' npm package (pure client-side canvas). Remove the QR <img> from the backend subpage defaultHTML too. - H-2: Add isTokenExpired() helper parsing JWT exp; useAuth now proactively logs out when the token has already expired instead of waiting for a 401. Full httpOnly-cookie migration documented as a follow-up (requires backend API changes). - MED-2: axios ^1.7.9 -> ^1.8.4 (CVE-2025-27152). - MED-3: Add CSP, X-Frame-Options: DENY, X-Content-Type-Options, referrer=same-origin meta tags to index.html. - MED-6: Remove leftover console.log(r.data) in Settings.tsx. - MED-7: Commit package-lock.json for reproducible builds (npm ci). - LOW-1: Simplify keep_token to !values.bot_token (consistent with Cluster.tsx). - LOW-2: Remove dead share Modal + state in Users.tsx. - LOW-6: Unify formatBytes in utils/format.ts (4 duplicates removed). - LOW-7: ChangePassword min length 6 -> 8. fix(frontend): local QR generation, JWT expiry, CSP, axios CVE - H-1: Subscription URIs / sub_tokens were sent to the third-party api.qrserver.com via GET query, leaking SS passwords / VMess UUIDs / sub_tokens to an untrusted service. Replace with a new QRCode.tsx component using the 'qrcode' npm package (pure client-side canvas). Remove the QR <img> from the backend subpage defaultHTML too. - H-2: Add isTokenExpired() helper parsing JWT exp; useAuth now proactively logs out when the token has already expired instead of waiting for a 401. Full httpOnly-cookie migration documented as a follow-up (requires backend API changes). - MED-2: axios ^1.7.9 -> ^1.8.4 (CVE-2025-27152). - MED-3: Add CSP, X-Frame-Options: DENY, X-Content-Type-Options, referrer=same-origin meta tags to index.html. - MED-6: Remove leftover console.log(r.data) in Settings.tsx. - MED-7: Commit package-lock.json for reproducible builds (npm ci). - LOW-1: Simplify keep_token to !values.bot_token (consistent with Cluster.tsx). - LOW-2: Remove dead share Modal + state in Users.tsx. - LOW-6: Unify formatBytes in utils/format.ts (4 duplicates removed). - LOW-7: ChangePassword min length 6 -> 8. fix(frontend): local QR generation, JWT expiry, CSP, axios CVE - H-1: Subscription URIs / sub_tokens were sent to the third-party api.qrserver.com via GET query, leaking SS passwords / VMess UUIDs / sub_tokens to an untrusted service. Replace with a new QRCode.tsx component using the 'qrcode' npm package (pure client-side canvas). Remove the QR <img> from the backend subpage defaultHTML too. - H-2: Add isTokenExpired() helper parsing JWT exp; useAuth now proactively logs out when the token has already expired instead of waiting for a 401. Full httpOnly-cookie migration documented as a follow-up (requires backend API changes). - MED-2: axios ^1.7.9 -> ^1.8.4 (CVE-2025-27152). - MED-3: Add CSP, X-Frame-Options: DENY, X-Content-Type-Options, referrer=same-origin meta tags to index.html. - MED-6: Remove leftover console.log(r.data) in Settings.tsx. - MED-7: Commit package-lock.json for reproducible builds (npm ci). - LOW-1: Simplify keep_token to !values.bot_token (consistent with Cluster.tsx). - LOW-2: Remove dead share Modal + state in Users.tsx. - LOW-6: Unify formatBytes in utils/format.ts (4 duplicates removed). - LOW-7: ChangePassword min length 6 -> 8. fix(frontend): local QR generation, JWT expiry, CSP, axios CVE - H-1: Subscription URIs / sub_tokens were sent to the third-party api.qrserver.com via GET query, leaking SS passwords / VMess UUIDs / sub_tokens to an untrusted service. Replace with a new QRCode.tsx component using the 'qrcode' npm package (pure client-side canvas). Remove the QR <img> from the backend subpage defaultHTML too. - H-2: Add isTokenExpired() helper parsing JWT exp; useAuth now proactively logs out when the token has already expired instead of waiting for a 401. Full httpOnly-cookie migration documented as a follow-up (requires backend API changes). - MED-2: axios ^1.7.9 -> ^1.8.4 (CVE-2025-27152). - MED-3: Add CSP, X-Frame-Options: DENY, X-Content-Type-Options, referrer=same-origin meta tags to index.html. - MED-6: Remove leftover console.log(r.data) in Settings.tsx. - MED-7: Commit package-lock.json for reproducible builds (npm ci). - LOW-1: Simplify keep_token to !values.bot_token (consistent with Cluster.tsx). - LOW-2: Remove dead share Modal + state in Users.tsx. - LOW-6: Unify formatBytes in utils/format.ts (4 duplicates removed). - LOW-7: ChangePassword min length 6 -> 8. fix(frontend): local QR generation, JWT expiry, CSP, axios CVE - H-1: Subscription URIs / sub_tokens were sent to the third-party api.qrserver.com via GET query, leaking SS passwords / VMess UUIDs / sub_tokens to an untrusted service. Replace with a new QRCode.tsx component using the 'qrcode' npm package (pure client-side canvas). Remove the QR <img> from the backend subpage defaultHTML too. - H-2: Add isTokenExpired() helper parsing JWT exp; useAuth now proactively logs out when the token has already expired instead of waiting for a 401. Full httpOnly-cookie migration documented as a follow-up (requires backend API changes). - MED-2: axios ^1.7.9 -> ^1.8.4 (CVE-2025-27152). - MED-3: Add CSP, X-Frame-Options: DENY, X-Content-Type-Options, referrer=same-origin meta tags to index.html. - MED-6: Remove leftover console.log(r.data) in Settings.tsx. - MED-7: Commit package-lock.json for reproducible builds (npm ci). - LOW-1: Simplify keep_token to !values.bot_token (consistent with Cluster.tsx). - LOW-2: Remove dead share Modal + state in Users.tsx. - LOW-6: Unify formatBytes in utils/format.ts (4 duplicates removed). - LOW-7: ChangePassword min length 6 -> 8.
34 lines
785 B
JSON
34 lines
785 B
JSON
{
|
|
"name": "frontend",
|
|
"private": true,
|
|
"version": "0.0.0",
|
|
"type": "module",
|
|
"scripts": {
|
|
"dev": "vite",
|
|
"build": "tsc -b && vite build",
|
|
"lint": "oxlint",
|
|
"preview": "vite preview"
|
|
},
|
|
"dependencies": {
|
|
"@ant-design/icons": "^6.3.2",
|
|
"@monaco-editor/react": "^4.7.0",
|
|
"antd": "^6.5.4",
|
|
"axios": "^1.8.4",
|
|
"qrcode": "^1.5.4",
|
|
"react": "^19.2.8",
|
|
"react-dom": "^19.2.8",
|
|
"react-router-dom": "^7.18.2",
|
|
"dayjs": "^1.11.19",
|
|
"zustand": "^5.0.3"
|
|
},
|
|
"devDependencies": {
|
|
"@types/node": "^24.13.3",
|
|
"@types/qrcode": "^1.5.5",
|
|
"@types/react": "^19.2.17",
|
|
"@types/react-dom": "^19.2.3",
|
|
"@vitejs/plugin-react": "^6.0.4",
|
|
"oxlint": "^1.75.0",
|
|
"typescript": "~6.0.2",
|
|
"vite": "^8.2.0"
|
|
}
|
|
} |