Commit graph

10 commits

Author SHA1 Message Date
OpenClaw
8a86e34f91 fix: critical and high-severity security fixes
All checks were successful
Deploy to Production / Deploy to Server (push) Successful in 2m52s
- CRITICAL: DNS rebinding SSRF - pin DNS resolution via request interception
- CRITICAL: XSS in billing success - use data-attribute instead of JS string
- HIGH: Webhook signature bypass - refuse unverified webhooks (500)
- HIGH: Filename header injection - sanitize Content-Disposition filename
- HIGH: Verification code timing attack - use crypto.timingSafeEqual()
- HIGH: Remove duplicate unreachable 404 handler
- HIGH: Add IPv6 unique local (fc00::/7) to SSRF private IP check
- HIGH: Replace console.warn with structured logger
2026-02-16 18:56:21 +00:00
c903860917 Enforce Pro plan limit of 5,000 PDFs/month
Some checks failed
Deploy to Production / Deploy to Server (push) Has been cancelled
2026-02-16 18:41:57 +00:00
OpenClaw
b98e8bc253 fix: BUG-046 usage endpoint data leak, BUG-047 copy button, BUG-048 email change links
All checks were successful
Deploy to Production / Deploy to Server (push) Successful in 1m18s
BUG-046 (CRITICAL): getUsageStats() now accepts apiKey param and returns
only that key usage instead of all users. Route passes req.apiKeyInfo.key.

BUG-047: Added visible Copy button to Pro key success page in billing.ts.

BUG-048: Added class="open-email-change" to Change Email links in all
HTML pages so the JS modal opener can find them.
2026-02-16 18:06:52 +00:00
OpenClaw
9541ae1826 Backend hardening: structured logging, timeouts, memory leak fixes, compression, XSS fix
Some checks failed
Deploy to Production / Deploy to Server (push) Failing after 20s
- Add pino structured logging with request IDs (X-Request-Id header)
- Add 30s timeout to acquirePage() and renderPdf/renderUrlPdf
- Add verification cache cleanup (every 15min) and rate limit cleanup (every 60s)
- Read version from package.json in health endpoint
- Add compression middleware
- Escape currency in templates (XSS fix)
- Add static asset caching (1h maxAge)
- Remove deprecated docker-compose version field
- Replace all console.log/error with pino logger
2026-02-16 08:27:42 +00:00
DocFast Bot
e9d16bf2a3 Migrate from JSON to PostgreSQL, update SLA to 99.5%
- Replace JSON file storage with PostgreSQL (pg package)
- Add db.ts service for connection pool and schema init
- Rewrite keys.ts, verification.ts, usage.ts for async PostgreSQL
- Update all routes for async function signatures
- Add migration script (scripts/migrate-to-postgres.mjs)
- Update docker-compose.yml with DATABASE_* env vars
- Change SLA from 99.9% to 99.5% in landing page
2026-02-15 10:18:25 +00:00
OpenClaw
efa39661cf feat: multi-browser pooling (2 Chromium instances × 8 pages)
- Launch BROWSER_COUNT separate Chromium instances (default: 2)
- Each with PAGES_PER_BROWSER pages (default: 8, 16 total)
- Round-robin distribution across browser instances
- Independent restart scheduling per browser
- Updated health endpoint to show per-browser stats
- docker-compose: added BROWSER_COUNT and PAGES_PER_BROWSER env vars
2026-02-14 21:55:29 +00:00
73bb041513 Security fixes: non-root user, signup rate limiting, differentiated CORS, persistent usage tracking 2026-02-14 17:04:55 +00:00
467a97ae1c fix: self-service signup, unified key store, persistent data volume
- Added /v1/signup/free endpoint for instant API key provisioning
- Built unified key store (services/keys.ts) with file-based persistence
- Refactored auth middleware to use key store (no more hardcoded env keys)
- Refactored usage middleware to check key tier from store
- Updated billing to use key store for Pro key provisioning
- Landing page: replaced mailto: link with signup modal
- Landing page: Pro checkout button now properly calls /v1/billing/checkout
- Added Docker volume for persistent key storage
- Success page now renders HTML instead of raw JSON
- Tested: signup → key → PDF generation works end-to-end
2026-02-14 14:20:05 +00:00
c12c1176b0 Add Stripe billing integration + update free tier to 100 PDFs/mo 2026-02-14 13:53:19 +00:00
6896b72e0c Add URL→PDF endpoint, usage tracking middleware, free tier limits 2026-02-14 13:02:40 +00:00