Diego Rodrigues de Sa e Souza ce3f2445a6 fix(security): namespace Notion thread cache per caller + validate client thread ids (IDOR) ...

Security-review follow-up to #7900. The notion-web thread-session cache was keyed only
by Notion spaceId (space-, not user-scoped) and accepted arbitrary client-supplied thread
ids, so two users of the same space could pin/read each other's thread. Now: (1) the cache
key includes hashNotionCallerCookie(cookie) so each caller gets an isolated namespace, and
(2) readClientThreadId rejects any value that is not a well-formed Notion UUID.

Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>

2026-07-22 08:07:32 -03:00

..

_setup

fix(test): skip real DNS writes in MITM dynamic-import test (#7398)

2026-07-18 21:18:49 -03:00

benchmarks

Release v3.8.2 (#2503)

2026-05-23 01:46:59 -03:00

boundary

Release v3.8.47 (#6569)

2026-07-13 09:12:40 -03:00

e2e

Release v3.8.43 (#5609)

2026-07-02 10:47:13 -03:00

fixtures

fix: bound quadratic session-dedup memory growth (#7855)

2026-07-20 15:55:55 -03:00

golden-set

feat(compression): expand caveman parity and MCP metadata compression

2026-05-03 09:14:20 -03:00

helpers

Fase 8 · Bloco B — suíte de correção (property + golden + SSE-correctness) (#3808)

2026-06-14 18:02:51 -03:00

homolog

feat(homolog): real-environment E2E homologation suite (npm run homolog) (#7133)

2026-07-14 16:24:11 -03:00

integration

perf: lazy provider init, P2C quota cache, structuredClone elimination, getSettings→getCachedSettings (batch 2) (#7893)

2026-07-21 11:50:14 -03:00

live

fix(security): resolve CodeQL ReDoS + URL sanitization alerts

2026-05-17 07:43:32 -03:00

llm-security

Fase 8 · Bloco D — injection-guard em todas as rotas LLM + red-team (#3857)

2026-06-14 18:02:18 -03:00

load

Release v3.8.45 (#6202)

2026-07-06 02:25:17 -03:00

manual

Release v3.8.47 (#6569)

2026-07-13 09:12:40 -03:00

security

feat: OmniRoute v1.0.0 — Intelligent AI Gateway & Universal LLM Proxy

2026-02-18 00:02:15 -03:00

snapshots

feat(providers): add hailuo-web (MiniMax web) chat provider (#6673) (#7734)

2026-07-21 21:40:31 -03:00

translator

chore: apply PR 1495 and update changelog

2026-04-21 21:12:29 -03:00

unit

fix(security): namespace Notion thread cache per caller + validate client thread ids (IDOR)

2026-07-22 08:07:32 -03:00

_cp_mock_hook.mts

fix(test): skip real DNS writes in MITM dynamic-import test (#7398)

2026-07-18 21:18:49 -03:00

_cp_mock_module.mts

[Emergency Fix] fix(build): repair release build blockers (#7772)

2026-07-19 15:51:23 -03:00

_run_dns_guard_test.sh

fix(test): skip real DNS writes in MITM dynamic-import test (#7398)

2026-07-18 21:18:49 -03:00

e2e-tool-calls.sh

Release v3.8.24 (#3747)

2026-06-13 17:27:40 -03:00

scratch_test.mjs

refactor: implement path utilities, add custom date formatting, improve type safety, and unify database imports

2026-04-21 21:10:48 -03:00

theoldllm-stress.test.ts

Honor provider proxies for The Old LLM Vercel blocks (#7380)

2026-07-18 15:13:13 -03:00