- Removed dangerouslySetInnerHTML with unsanitized user input
- Removed highlightCommit prop and related highlighting logic
- Added download and rel="noopener noreferrer" attributes to download link
- Simplified component to safely display filename without HTML rendering
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
- Add secure and sameSite attributes to cookie configuration
- Add try-catch block to handle malformed JSON and other errors
- Add validation for missing username or password fields
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
- Replace fs.readFileSync() with fs.createReadStream() to prevent memory exhaustion
- Export validatePath() from fs-utils.ts
- Use validatePath() to validate full path including project and version parameters
- Fix incomplete path traversal protection
- Add filename encoding in Content-Disposition header
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
- Add encodeURIComponent() for project, version, and filename parameters in downloadUrl to prevent XSS and URL breakage
- Remove unused formatDateTime import
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
- Fixed race condition in getProjects() by using Promise.all with proper async/await
- Fixed race condition in getVersions() by using Promise.all with proper async/await
- Fixed race condition in getApks() by ensuring Promise.all wraps the async map
- Added validatePath() helper function to prevent path traversal attacks
- Applied path validation to all file system operations
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
- Initialize Next.js 16.1.6 with TypeScript and App Router
- Configure Tailwind CSS for styling
- Install SWR for API state management
- Set up environment variables for authentication and resource path
- Update .gitignore to track .env.local
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
