Skip to content

feat: security hardening, streaming fix, CORS, pagination & tags endpoint - #113

Open
upsightx wants to merge 8 commits into
FreeU-group:mainfrom
upsightx:main
Open

feat: security hardening, streaming fix, CORS, pagination & tags endpoint#113
upsightx wants to merge 8 commits into
FreeU-group:mainfrom
upsightx:main

Conversation

@upsightx

@upsightx upsightx commented Mar 7, 2026

Copy link
Copy Markdown

Changes

Security

  • XSS Prevention: Sanitize HTML in todo input fields to prevent stored XSS attacks

Bug Fixes

  • Streaming Chat: Use text/event-stream content type for SSE streaming responses
  • Time Validation: Validate that start_time must be before end_time

Features

  • CORS Middleware: Add CORS middleware for browser-based clients
  • Pagination: Add pagination support (page, page_size) to GET /api/todos
  • Tags Endpoint: Add GET /api/tags endpoint for listing all tags, registered via module system

Testing

  • Comprehensive test report covering 70+ test cases across CRUD, stress, AI, security, and edge cases
  • See TEST_RESULTS.md for full details

Tested against a local deployment with the LLM relay configured. All core CRUD, hierarchical tasks, calendar/ICS export, sorting/reorder, and concurrent operations pass.

penggaolai and others added 6 commits March 17, 2026 16:31
- 撤回ML依赖可选组(会导致全新安装ImportError)
- 撤回全局no-build-isolation(改为hdbscan专用extra-build-dependencies)
- 合并重复的embedding加载日志为一条中文提示
- 重新生成uv.lock
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Use text/event-stream content type for SSE streaming responses.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants