Skip to content

Cleanup#5433

Open
bbbreaddd wants to merge 15 commits into
fmhy:mainfrom
bbbreaddd:pr11
Open

Cleanup#5433
bbbreaddd wants to merge 15 commits into
fmhy:mainfrom
bbbreaddd:pr11

Conversation

@bbbreaddd

@bbbreaddd bbbreaddd commented May 31, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

While I was working with the site, I noticed some small things that were annoying. These changes pretty much only affect people developing for the site. (Not anymore ig)

  • Modified the generate-removed script to work on any platform, not just Linux
  • Modified the git hook to not force the lint-markdown.js to give no errors to make any commits (especially since false positives can happen)
  • Cleaned up some outdated pnpm stuff to give less errors
  • and I ran eslint to clean up some stuff

@bbbreaddd bbbreaddd requested a review from taskylizard as a code owner May 31, 2026 10:44
@bbbreaddd

bbbreaddd commented May 31, 2026

Copy link
Copy Markdown
Contributor Author

Also reduced the requirements for node. The site doesn't require Node >25 and it's probably best to not require a non-LTS version anyways.

@bbbreaddd

bbbreaddd commented May 31, 2026

Copy link
Copy Markdown
Contributor Author

Rebased the commits to fix the conflicts.

@nbats nbats marked this pull request as draft May 31, 2026 15:22
bbbreaddd and others added 5 commits June 3, 2026 23:00
@bbbreaddd @claude
fix(api): harden routes — timeouts, IP validation, input sanitization
5df1fec 
- single-page: Promise.allSettled + per-fetch timeout so one slow/down
  GitHub file no longer hangs or 500s the whole endpoint (C5/H9); relax
  cache to stale-while-revalidate (M13)
- feedback: sanitize message/heading before Discord embed (@everyone,
  backticks) (C6); validate client IP, prefer cf-connecting-ip (H1/H8);
  log webhook failure body and return 502 (M5); reject oversized bodies (P4)
- ratelimit: 429 status on limit, drop double type-cast, validate IP (L1/L2/H8)
- cors: restrict methods to GET/POST/OPTIONS (H2)
- Feedback schema: reject script/js/handler content + path regex (M4)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@bbbreaddd @claude
fix(build): propagate hook errors, guard frontmatter, harden scripts
a6c1636 
- config buildEnd: catch+rethrow so a failed OG/RSS hook fails the build
  instead of silently logging 'Success!' (C8)
- opengraph: optional-chain frontmatter.hero so home pages without a hero
  block don't throw (M2)
- rss: skip posts missing a title instead of emitting 'undefined' (H11)
- shared: treat 0/no/off/false (any case) as build-off, not just 'false' (M9)
- generate-removed: add execSync timeouts, log the swallowed git-config
  error, validate temp path before rmSync (H7/L5/L6)
- engines: relax node to >=20 to match CI reality (M1); gh-pages fetch-depth
  0 so generate-removed has git history (H12)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@bbbreaddd @claude
fix(theme): correct error display and event-listener lifecycles
9715aca 
- Feedback: show err.message string instead of assigning the Error object,
  which rendered as '[object Error]' (H10)
- Clock/SearchBar: hoist interval/handler refs to setup scope and use
  top-level onUnmounted instead of nesting it inside onMounted (H3/H4)
- ThemeDropdown: tear down previous flyout listeners before re-adding so
  they can't accumulate (H5)
- themeHandler: store the matchMedia listener as a stable ref, make init
  idempotent, and add destroy() to remove it (H6)
- transformer: branch on typeof replace instead of casting to any (M8)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@bbbreaddd @claude
fix(security): sanitize/escape untrusted HTML in render paths
cd49701 
- Add dompurify + a client-guarded sanitize composable (sanitizeSvg,
  sanitizeSearchHtml, sanitizeRichHtml); SSR-safe no-op without a DOM
- Bookmarks: sanitize user-supplied custom SVG at render so stored
  localStorage payloads can't execute script (C4)
- search box: sanitize the three v-html bindings — titles keep mark/emphasis,
  excerpt keeps rich formatting but drops scripts/handlers (C3)
- base64 plugin: escape decoded content for the JS-string-in-attribute
  context and HTML-escape the displayed code (C1)
- headers plugin: HTML-escape heading before the Feedback attribute (C2)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@bbbreaddd @claude
fix(misc): a11y labels, dead comment, self-hosted webhook avatar
d9a03e7 
- ThemeDropdown: add aria-label to the icon-only toggle button (L3)
- WallpaperCard: make alt text distinct from the visible title (L4)
- constants: drop meaningless biome-ignore comment (project uses ESLint) (L7)
- feedback: point Discord avatar at a self-hosted asset (M15)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@bbbreaddd

bbbreaddd commented Jun 5, 2026

Copy link
Copy Markdown
Contributor Author

Someone gave a list of "bugs and security vulnerabilities" that Claude found, so I let Claude "fix" them. Still need to go in and review it and make sure nothing broke.

@bbbreaddd

bbbreaddd commented Jun 7, 2026

Copy link
Copy Markdown
Contributor Author

Well this PR became a lot bigger than I meant for it to be. It's still mostly backend changes that shouldn't affect the main user though. Things like cleaning up some code, making things more robust, adding better error handling, fixing security stuff.
Here are the main changes:

  • Improved ratelimit in Feedback to prevent spoofed IPs
  • Feedback messages escape @everyone and @here pings and strips codeblocks
  • Moved feedback avatar to be hosted on the site rather than a third party host
  • Modified Git Hooks to use cache and to only check staged files.
  • Patched XSS and other vulnerabilities (even in base64.ts which isn't used anymore but why not ig)
  • Added better error handling
  • Improved single-page API (the old one) to have a 10s timeout
  • Added unused circle animation for dark and light theme switcher. Tasky added it a long time ago, but not sure why it wasn't used.
  • Fixed possible memory leaks, mainly in the startpage
  • Reduced required node version. The project doesn't need the latest version, so why limit ourselves to it. It's better not to force everyone to use a non-LTS version anyways
  • Modified generate-removed.js to be more universal instead of working only on unix OSes.
  • Cleaned up dead code

Preview: https://f60f91d9.edit-b69.pages.dev/
although I wouldn't say there is that much different to see other than the light/dark theme switcher. Still doesn't hurt to try it out and see if anything is broken. I tested it out on many different devices though and everything seems to be good.

@bbbreaddd bbbreaddd marked this pull request as ready for review June 7, 2026 01:34
@bbbreaddd

bbbreaddd commented Jun 7, 2026

Copy link
Copy Markdown
Contributor Author

Also the deleted characters is at 16k mainly because I removed the package-lock.json which was -16,463 characters

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@taskylizard taskylizard Awaiting requested review from taskylizard taskylizard is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@bbbreaddd