Cheri Wen 0ae3329613 fix: sanitize API key name with html.EscapeString to prevent stored XSS (CWE-79) ...

HTML-encode user-supplied key names in both Create and Update
endpoints. Previously, names were stored verbatim — an attacker
could inject script tags that would execute in admin panels or
any view using innerHTML/v-html rendering.

Fixes: CWE-79 (Stored Cross-Site Scripting)

2026-06-02 00:46:29 +08:00

..

cmd

Merge pull request #2881 from xiaoyiluck666/fix/openai-oauth-refresh-enrichment

2026-06-01 10:04:16 +08:00

ent

feat(group): 支持自定义 /v1/models 模型列表

2026-05-27 18:00:45 +08:00

internal

fix: sanitize API key name with html.EscapeString to prevent stored XSS (CWE-79)

2026-06-02 00:46:29 +08:00

migrations

feat: 适配 claude-opus-4-8

2026-05-29 09:56:48 +08:00

resources/model-pricing

chore(pricing): update model pricing metadata

2026-05-29 16:29:29 +08:00

.dockerignore

feat(ops): 增强上游错误追踪和新增定时报告服务

2026-01-11 23:00:31 +08:00

.golangci.yml

fix(ci): 精简golangci-lint配置解决v2.11超时问题

2026-03-07 15:17:16 +08:00

Dockerfile

chore: 修复 CI 安全与 lint 检查

2026-05-08 14:42:20 +08:00

go.mod

feat(quota): 用户 × 平台 USD 配额

2026-05-26 10:49:20 +08:00

go.sum

feat(quota): 用户 × 平台 USD 配额

2026-05-26 10:49:20 +08:00

Makefile

feat(sync): full code sync from release

2026-02-28 15:01:20 +08:00