QT/sure
1
0
Fork 0
mirror of https://github.com/we-promise/sure.git synced 2026-07-27 20:22:16 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
17b8fe24091121bc6dca0c05d20e374a098af2e6
sure/test
History
RealDiligent 17b8fe2409 fix: block unsafe OAuth redirect URIs in dynamic registration (#2638) 
* fix: resolve insecure OAuth redirect URI registration

Reject unsafe redirect URIs during dynamic OAuth client registration so only HTTPS and loopback HTTP callbacks are accepted. This prevents token/code exfiltration through attacker-controlled redirect targets while preserving local native client flows.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix: normalize IPv6 loopback hosts in OAuth redirect validation

Strip bracketed IPv6 hosts before comparing against LOOPBACK_HOSTS so
http://[::1] callbacks are accepted as intended.

Co-authored-by: Cursor <cursoragent@cursor.com>

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-22 00:41:58 +02:00
..
architecture
refactor(api): scope controllers through current_resource_owner (#2414)
2026-06-28 21:59:44 +02:00
channels/application_cable
Initial commit
2024-02-02 09:05:04 -06:00
components
Fix N+1 queries on categories index by batching lookups and removing … (#2163)
2026-07-21 10:00:15 +02:00
controllers
fix: block unsafe OAuth redirect URIs in dynamic registration (#2638)
2026-07-22 00:41:58 +02:00
data_migrations
Additional cache columns on balances for activity view breakdowns (#2505)
2025-07-23 10:06:25 -04:00
fixtures
feat(bank-sync): Wise integration (#2433)
2026-07-14 03:16:28 +02:00
helpers
fix(impersonation): guard Sidekiq jobs link (#2678)
2026-07-14 02:41:29 +02:00
integration
feat(sidekiq): mount Web UI in production behind super-admin sessions (#2683)
2026-07-17 07:00:27 +02:00
interfaces
fix(import): strip non-breaking-space thousands separators in sanitize_number (#2538)
2026-07-17 07:38:46 +02:00
javascript
feat: resizable accounts & assistant sidebars (#2482)
2026-06-26 06:45:08 +02:00
jobs
feat(insights): proactive financial intelligence feed (#2550)
2026-07-14 02:19:39 +02:00
lib
Stop backfill_encryption double-encoding json/jsonb columns (#2615)
2026-07-08 08:05:49 +02:00
mailers
Add send_email_notification rule action (#2527)
2026-07-17 23:00:18 +02:00
migrations
Add Plaid migration constant alias (#1235)
2026-03-21 01:03:19 +01:00
models
fix(snaptrade): don't double count cash-equivalent (money market) positions (#2696)
2026-07-21 23:29:58 +02:00
policies
refactor: improve SSO provider management and logging
2026-01-03 21:13:24 -05:00
services
fix: use REDIS_URL in ApiRateLimiter for hosted API requests (#2639)
2026-07-21 09:59:28 +02:00
support
Fix income trades (interest/dividend) wiping security holdings to $0 (#2673)
2026-07-14 01:33:35 +02:00
system
Fix N+1 queries on categories index by batching lookups and removing … (#2163)
2026-07-21 10:00:15 +02:00
vcr_cassettes
More rebranding changes (#159)
2025-09-24 00:19:51 +02:00
views
Fix N+1 queries on categories index by batching lookups and removing … (#2163)
2026-07-21 10:00:15 +02:00
api_endpoint_consistency_rule_test.rb
feat: Add LLM prompt for API endpoint consistency (#949)
2026-02-10 23:36:25 +01:00
application_system_test_case.rb
Add Actual Budget CSV import flow (#1830)
2026-05-18 18:38:53 +02:00
encryption_verification_test.rb
Initial security fixes (#461)
2026-01-23 22:05:28 +01:00
i18n_test.rb
New Design System + Codebase Refresh (#1823)
2025-02-21 11:57:59 -05:00
test_helper.rb
perf(dashboard): streamline investment activity totals (#2257)
2026-06-18 20:18:18 +02:00