sec: clamp CourtListener egress, disable pdf.js eval, drop orphan page counter
courtlistenerFetch follows absolute URLs from API payloads (pagination next links) with the Authorization token attached; it now refuses any origin other than courtlistener.com/storage.courtlistener.com so a poisoned link cannot exfiltrate the token. All four pdf.js getDocument sites set isEvalSupported: false - untrusted uploads never reach the eval-based font compiler (defense in depth over the CVE-2024-4367 class). projects.ts drops the countPdfPages copy orphaned by the upload-handler dedup. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QUsMXzBsEJ27DjJVPSfW5o
| Repository | eliziff/Beaver |
|---|---|
| Author | Eli Ziff <eliasziff@gmail.com> |
| Authored | |
| Parents | 910b0920 |
| Stats | 5 files changed , +21 , -19 |
| Part of | Security and dependency hardening |
Capture this commit into my fork
Download a Markdown prompt that tells Claude how to port this
exact commit into your working tree. Run it via
claude -p < capture-commit-310a2f35.md
from inside the repo you want the change in.