sunpeak 0.13.5 → 0.13.6

package/dist/chatgpt/iframe-resource.d.ts

@@ -20,6 +20,11 @@ export interface ResourceCSP {
     /** Domains allowed for scripts, images, styles, fonts */
     resourceDomains?: string[];
 }
+/**
+ * Validates a CSP source entry is a safe origin URL (scheme + host + optional port).
+ * Rejects wildcards, CSP keywords, and whitespace that could inject extra directives.
+ */
+declare function isValidCspSource(source: string): boolean;
 /**
  * Generates a Content Security Policy string.
  */
@@ -85,6 +90,7 @@ export declare function IframeResource({ src, scriptSrc, hostContext, toolInput,
 export declare const _testExports: {
     escapeHtml: typeof escapeHtml;
     isAllowedUrl: typeof isAllowedUrl;
+    isValidCspSource: typeof isValidCspSource;
     generateCSP: typeof generateCSP;
     generateScriptHtml: typeof generateScriptHtml;
     ALLOWED_SCRIPT_ORIGINS: string[];

package/dist/chatgpt/index.cjs

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const chatgpt_index = require("../index-FiqdlIXV.cjs");
+const chatgpt_index = require("../index-B_In_BWg.cjs");
 const discovery = require("../discovery-CRR3SlyI.cjs");
 exports.ChatGPTSimulator = chatgpt_index.ChatGPTSimulator;
 exports.IframeResource = chatgpt_index.IframeResource;

package/dist/chatgpt/index.js

@@ -1,4 +1,4 @@
-import { C, I, M, S, T, a, u } from "../index-BMqwRYBo.js";
+import { C, I, M, S, T, a, u } from "../index-CkEAx7FS.js";
 import { a as a2, b, d, c, e, f, g, h, i, j, k, l, t } from "../discovery-COZUnY6a.js";
 export {
   C as ChatGPTSimulator,

package/dist/{index-FiqdlIXV.cjs → index-B_In_BWg.cjs}

@@ -5442,7 +5442,7 @@ const useEscCloseStack = (listening, cb) => {
   }, [id, listening, latestCallback]);
 };
 const __vite_import_meta_env__ = { "DEV": false, "MODE": "production" };
-const META_ENV = typeof { url: typeof document === "undefined" ? require("url").pathToFileURL(__filename).href : _documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === "SCRIPT" && _documentCurrentScript.src || new URL("index-FiqdlIXV.cjs", document.baseURI).href } !== "undefined" ? __vite_import_meta_env__ : void 0;
+const META_ENV = typeof { url: typeof document === "undefined" ? require("url").pathToFileURL(__filename).href : _documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === "SCRIPT" && _documentCurrentScript.src || new URL("index-B_In_BWg.cjs", document.baseURI).href } !== "undefined" ? __vite_import_meta_env__ : void 0;
 const NODE_ENV = typeof process !== "undefined" && process.env?.NODE_ENV ? process.env?.NODE_ENV : "production";
 const isDev = NODE_ENV === "development" || !!META_ENV?.DEV;
 const isJSDomLike = typeof navigator !== "undefined" && /(jsdom|happy-dom)/i.test(navigator.userAgent) || typeof globalThis.happyDOM === "object";
@@ -14094,6 +14094,16 @@ class McpAppHost {
       if (this.options.onOpenLink) {
         this.options.onOpenLink(url);
       } else {
+        try {
+          const parsed = new URL(url);
+          if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+            console.warn("[MCP App] openLink blocked non-http(s) URL:", url);
+            return {};
+          }
+        } catch {
+          console.warn("[MCP App] openLink blocked invalid URL:", url);
+          return {};
+        }
         window.open(url, "_blank");
       }
       return {};
@@ -14175,6 +14185,7 @@ class McpAppHost {
     const id = ++this._fenceId;
     return new Promise((resolve) => {
       const handler = (event) => {
+        if (event.source !== win) return;
         if (event.data?.method === "sunpeak/fence-ack" && event.data.params?.fenceId === id) {
           cleanup();
           resolve();
@@ -14317,6 +14328,15 @@ function isAllowedUrl(src) {
   }
 }
 const SDK_RESOURCE_DOMAINS = ["https://cdn.openai.com"];
+function isValidCspSource(source) {
+  if (!source || /[\s;,']/.test(source) || source === "*") return false;
+  try {
+    const url = new URL(source);
+    return url.protocol === "http:" || url.protocol === "https:" || url.protocol === "ws:" || url.protocol === "wss:";
+  } catch {
+    return false;
+  }
+}
 function generateCSP(csp, scriptSrc) {
   let scriptOrigin = "";
   try {
@@ -14334,14 +14354,26 @@ function generateCSP(csp, scriptSrc) {
   const connectSources = /* @__PURE__ */ new Set(["'self'"]);
   if (scriptOrigin) connectSources.add(scriptOrigin);
   if (csp?.connectDomains) {
-    for (const domain of csp.connectDomains) connectSources.add(domain);
+    for (const domain of csp.connectDomains) {
+      if (isValidCspSource(domain)) {
+        connectSources.add(domain);
+      } else {
+        console.warn("[IframeResource] Ignoring invalid CSP connect domain:", domain);
+      }
+    }
   }
   directives.push(`connect-src ${Array.from(connectSources).join(" ")}`);
   const resourceSources = /* @__PURE__ */ new Set(["'self'", "data:", "blob:"]);
   if (scriptOrigin) resourceSources.add(scriptOrigin);
   for (const domain of SDK_RESOURCE_DOMAINS) resourceSources.add(domain);
   if (csp?.resourceDomains) {
-    for (const domain of csp.resourceDomains) resourceSources.add(domain);
+    for (const domain of csp.resourceDomains) {
+      if (isValidCspSource(domain)) {
+        resourceSources.add(domain);
+      } else {
+        console.warn("[IframeResource] Ignoring invalid CSP resource domain:", domain);
+      }
+    }
   }
   const resourceList = Array.from(resourceSources).join(" ");
   directives.push(`img-src ${resourceList}`);
@@ -14352,8 +14384,9 @@ function generateCSP(csp, scriptSrc) {
 function generateScriptHtml(scriptSrc, theme, cspPolicy) {
   const safeScriptSrc = escapeHtml(scriptSrc);
   const safeCsp = escapeHtml(cspPolicy);
+  const safeTheme = escapeHtml(theme);
   return `<!DOCTYPE html>
-<html lang="en" data-theme="${theme}">
+<html lang="en" data-theme="${safeTheme}">
 <head>
   <meta charset="UTF-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1.0" />
@@ -15100,4 +15133,4 @@ exports.clsx = clsx;
 exports.createSimulatorUrl = createSimulatorUrl;
 exports.index = index;
 exports.useThemeContext = useThemeContext;
-//# sourceMappingURL=index-FiqdlIXV.cjs.map
+//# sourceMappingURL=index-B_In_BWg.cjs.map