Skip to content

Commit b976d8f

Browse files
claudeAdamJ
claude
authored and
AdamJ
committed
fix: Improve safety, security, and stability
Security: - Remove unverified third-party script (cdn.gpteng.co/gptengineer.js) - Add Content Security Policy meta tag (connect-src, frame-src, object-src, base-uri) - Patch 12 high-severity npm vulnerabilities via audit fix + overrides - Move Gemini API calls server-side via Supabase Edge Function (ai-proxy); VITE_GEMINI_API_KEY no longer exposed to the browser Stability: - Wrap all localStorage.setItem calls in try-catch to handle QuotaExceededError and private/incognito mode (Safari) without crashing - Fix beforeunload handler: async save replaced with synchronous localStorage write as a crash-safe backup (async saves cannot be awaited on page unload) - Replace Promise.all with Promise.allSettled in forceSyncToDatabase so a single failed save no longer silently leaves other data in an inconsistent state - Show destructive toast when endDay save fails instead of only logging to console - Add private requireUser() helper in SupabaseService to validate user ID before every DB operation; removes scattered inconsistent null-check pattern - Wrap localStorage access in InstallPrompt in try-catch for private mode safety - Sanitize chart ID and color values before interpolation into dangerouslySetInnerHTML - Add SCHEMA_VERSION stamp to all localStorage writes; version mismatch on read clears stale data and returns safe defaults instead of passing corrupt state through the application; legacy bare-array format remains readable https://claude.ai/code/session_01JorBRWb89cm8BakhSoeWVx
1 parent a2d4a78 commit b976d8f

12 files changed

Lines changed: 4231 additions & 4006 deletions

File tree

‎index.html‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,12 +35,28 @@
3535
<meta name="mobile-web-app-capable" content="yes" />
3636
<meta name="application-name" content="TimeTracker Pro" />
3737

38+
<!-- Content Security Policy -->
39+
<meta
40+
http-equiv="Content-Security-Policy"
41+
content="
42+
default-src 'self';
43+
script-src 'self' 'unsafe-inline';
44+
style-src 'self' 'unsafe-inline';
45+
connect-src 'self' https://*.supabase.co wss://*.supabase.co https://generativelanguage.googleapis.com;
46+
font-src 'self' data:;
47+
img-src 'self' data: blob:;
48+
frame-src 'none';
49+
object-src 'none';
50+
base-uri 'self';
51+
form-action 'self';
52+
"
53+
/>
54+
3855
<link rel="stylesheet" href="/print.css" media="print" />
3956
<link rel="stylesheet" href="/pwa.css" />
4057
</head>
4158
<body>
4259
<div id="root"></div>
4360
<script type="module" src="/src/main.tsx"></script>
44-
<script src="https://cdn.gpteng.co/gptengineer.js" defer></script>
4561
</body>
4662
</html>

0 commit comments

Comments
 (0)