0 Fork 0

mirror of https://github.com/paperclipai/paperclip.git synced 2026-10-26 10:26:26 +01:00

Files

T

DottaandClaude Opus 5 920fe47d35 fix(security): validate discovered OAuth endpoints before browser navigation

A generic remote MCP connection lets the server it points at advertise its own
authorization-server metadata, and `authorization_endpoint` was accepted as an
arbitrary string: `startOAuth` built a `URL` from it and the board passed the
result to `window.location.assign`. A hostile server could therefore advertise
`javascript:`/`data:` to run script in the board's origin, `file:` to read a
local path, or plain `http:`/a credential-bearing URL to downgrade or disguise
where the operator was being sent.

Parse every OAuth endpoint through one shared validator instead — discovered
metadata, `WWW-Authenticate` hints, pasted/persisted config, and gallery
defaults alike. It requires https (loopback http only under the existing
local-development policy, plus this deployment's own origin, which is how the
smoke-lab fixture is served), and rejects embedded credentials, fragments and
malformed values. Discovery drops an unusable endpoint so a second advertised
authorization server still gets a chance, and raises the refusal only if nothing
safe was found — so an unsafe value is never persisted and never reported as a
bare "does not advertise OAuth sign in". The token and registration endpoints go
through the same gate, so a row written before this existed cannot send a code or
client secret over plaintext.

The board applies the same validator at the navigation boundary rather than
trusting the response body, and — since a valid HTTPS page can still phish —
names the authorization host on the redirect screen while keeping the
"Unverified server" label.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-08-20 21:20:01 +00:00

public

fix(ui): always give respondWith a real Response in the sw fetch fallback (#11292 )

2026-08-12 11:23:18 -07:00

src

fix(security): validate discovered OAuth endpoints before browser navigation

2026-08-20 21:20:01 +00:00

storybook

Add governed secret alias confirmation cards (#11486 )

2026-08-18 09:44:24 -05:00

components.json

Overhaul UI with shadcn components and new pages

2026-02-17 09:07:32 -06:00

index.html

fix(ui): fetch the web app manifest with credentials (#11245 )

2026-08-11 19:11:56 -07:00

package.json

feat: add kimi-local adapter for Kimi Code CLI (CLI + ACP engines) (#9967 )

2026-08-20 12:06:33 -07:00

README.md

[codex] add comprehensive UI Storybook coverage (#4132 )

2026-04-20 12:13:23 -05:00

tsconfig.json

chore(ui): remove deprecated baseUrl from ui/tsconfig.json (#4067 )

2026-08-04 18:39:13 -05:00

vite.config.ts

revert(ui): back out onboarding port (#10786 ) (#11067 )

2026-08-07 14:55:34 -07:00

vite.qa.config.mjs

feat(mcp) [split 7/8]: activate Apps and gateway UI (#9562 )

2026-07-14 15:40:08 -05:00

vitest.config.ts

refactor(ui): drop the TZ pin now the fixtures are anchored (#11508 )

2026-08-17 00:18:13 -07:00

vitest.setup.ts

feat(ui): NUX rework behind enableConferenceRoomChat experimental flag — capsule onboarding, conference-room chat, unified composer (#8000 )

2026-06-11 16:32:55 -05:00

README.md

@paperclipai/ui

Published static assets for the Paperclip board UI.

What gets published

The npm package contains the production build under dist/. It does not ship the UI source tree or workspace-only dependencies.

Storybook

Storybook config, stories, and fixtures live under ui/storybook/.

pnpm --filter @paperclipai/ui storybook
pnpm --filter @paperclipai/ui build-storybook

Typical use

Install the package, then serve or copy the built files from node_modules/@paperclipai/ui/dist.