@goodandready/dsh-tts 0.4.21 → 0.4.22
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +5 -0
- package/lib/routes.js +3 -0
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -2,6 +2,11 @@
|
|
|
2
2
|
|
|
3
3
|
Notable changes to `@goodandready/dsh-tts`.
|
|
4
4
|
|
|
5
|
+
## 0.4.22
|
|
6
|
+
|
|
7
|
+
### Fixed
|
|
8
|
+
- Enforce fail-closed `isTrustedSettingsRequest(req)` validation on `/stream`, `/pending`, and `/speak` HTTP handlers to reject untrusted cross-site requests with 403 Forbidden (#136).
|
|
9
|
+
|
|
5
10
|
## 0.4.21
|
|
6
11
|
|
|
7
12
|
### Fixed
|
package/lib/routes.js
CHANGED
|
@@ -58,6 +58,7 @@ export function registerHttpRoutes(ctx, api) {
|
|
|
58
58
|
path: '/dsh-tts/stream',
|
|
59
59
|
handler: async (req, res) => {
|
|
60
60
|
if (req.method !== 'GET') { writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET only' } }); return }
|
|
61
|
+
if (!isTrustedSettingsRequest(req)) { writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } }); return }
|
|
61
62
|
try {
|
|
62
63
|
res.writeHead(200, {
|
|
63
64
|
'Content-Type': 'text/event-stream',
|
|
@@ -376,6 +377,7 @@ export function registerHttpRoutes(ctx, api) {
|
|
|
376
377
|
path: '/dsh-tts/pending',
|
|
377
378
|
handler: async (req, res) => {
|
|
378
379
|
if (req.method !== 'GET') { writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET only' } }); return }
|
|
380
|
+
if (!isTrustedSettingsRequest(req)) { writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } }); return }
|
|
379
381
|
const url = new URL(req.url || '/', 'http://127.0.0.1')
|
|
380
382
|
const after = url.searchParams.get('after') || ''
|
|
381
383
|
let items = pending.slice()
|
|
@@ -392,6 +394,7 @@ export function registerHttpRoutes(ctx, api) {
|
|
|
392
394
|
path: '/dsh-tts/speak',
|
|
393
395
|
handler: async (req, res) => {
|
|
394
396
|
if (req.method !== 'POST') { writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } }); return }
|
|
397
|
+
if (!isTrustedSettingsRequest(req)) { writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } }); return }
|
|
395
398
|
let raw
|
|
396
399
|
try { raw = await readBody(req, 256 * 1024) } catch (e) {
|
|
397
400
|
writeJson(res, 400, { ok: false, error: { code: 'body', message: e.message } }); return
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@goodandready/dsh-tts",
|
|
3
|
-
"version": "0.4.
|
|
3
|
+
"version": "0.4.22",
|
|
4
4
|
"description": "Text-to-speech for DeepSeek Harness: speak agent replies in the Web UI with a provider fallback chain (OpenAI, ElevenLabs, Google, Azure, Groq, Deepgram, OpenRouter, Edge, Piper, eSpeak).",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"type": "module",
|