Cheri Wen 0ae3329613 fix: sanitize API key name with html.EscapeString to prevent stored XSS (CWE-79) ...

HTML-encode user-supplied key names in both Create and Update
endpoints. Previously, names were stored verbatim — an attacker
could inject script tags that would execute in admin panels or
any view using innerHTML/v-html rendering.

Fixes: CWE-79 (Stored Cross-Site Scripting)

2026-06-02 00:46:29 +08:00

..

cmd

Merge pull request #2881 from xiaoyiluck666/fix/openai-oauth-refresh-enrichment

2026-06-01 10:04:16 +08:00

ent

feat(group): 支持自定义 /v1/models 模型列表

2026-05-27 18:00:45 +08:00

internal

fix: sanitize API key name with html.EscapeString to prevent stored XSS (CWE-79)

2026-06-02 00:46:29 +08:00

migrations

feat: 适配 claude-opus-4-8

2026-05-29 09:56:48 +08:00

resources/model-pricing

chore(pricing): update model pricing metadata

2026-05-29 16:29:29 +08:00

.dockerignore

…

.golangci.yml

…

Dockerfile

…

go.mod

feat(quota): 用户 × 平台 USD 配额

2026-05-26 10:49:20 +08:00

go.sum

feat(quota): 用户 × 平台 USD 配额

2026-05-26 10:49:20 +08:00

Makefile

…