mirror of
https://github.com/danny-avila/LibreChat.git
synced 2026-08-28 04:37:37 +00:00
cd80c8d68e
Compile form-style query expansions as a bounded ordered sequence in which each non-exploded
declared variable contributes at most once, so db://items{?id} no longer authorizes
db://items?id=public&id=admin, which no conforming expansion produces and which a server using
first or last value semantics would resolve. Prefix bounds compose as a per-key value limit, an
explode modifier still permits its own key to repeat, and query expansions now share the same
declared-variable ceiling as the other ordered compiler.
Resolve the sandbox bootstrap injection point by scanning past comments, CDATA and raw-text spans
instead of matching the first head-like text. App HTML containing a commented head tag previously
received the attestation bootstrap inside the comment, so it never executed and every bridge message
queued until the view timed out. Anything unresolvable falls back to wrapping the document, which
keeps the marker check and the bootstrap ahead of all untrusted markup.
Key app tool and resource authorization metadata by connection identity rather than by user when the
connection is the shared app-level instance. Every user of a global server previously added a
permanent entry to six maps, and the per-user cleanup path never runs for app-level connections.
User-scoped connections keep separate entries, since their tool sets and visibility can differ.
Also drop three unrelated files that a previous merge committed by accident: two draft patch
artifacts and a local docker compose override.
|
||
|---|---|---|
| .. | ||
| src | ||
| types | ||
| .gitignore | ||
| babel.config.cjs | ||
| jest.config.mjs | ||
| jest.setup.cjs | ||
| package.json | ||
| tsconfig-paths-bootstrap.mjs | ||
| tsconfig.build.json | ||
| tsconfig.json | ||
| tsconfig.spec.json | ||
| tsdown.config.mjs | ||