Comment on Probably want to stop using Booklore...

• nfreak@lemmy.ml ⁨3⁩ ⁨weeks⁩ ago

  There is this that popped up the other day, but I haven’t looked into it at all to see if it’s vibecoded or not: github.com/fccview/degoog

  source

  • PoliteDudeInTheMood@lemmy.ca ⁨3⁩ ⁨weeks⁩ ago

    It’s not, the second I cloned it and gave codex access it found a whole whack of privacy issues. This was 100% human coded

    source

    • fccview@lemmy.world ⁨2⁩ ⁨weeks⁩ ago

      degoog Dev here, definitely not vibecoded. Would you be able to tell me all these whack of privacy issues? I thought I had everything covered, but if you found something concerning it’d be nice to know before I get it out of beta :)

      source

      • PoliteDudeInTheMood@lemmy.ca ⁨2⁩ ⁨weeks⁩ ago

        1. Fixed credential-exfiltration risk in /api/proxy/image: Previously the endpoint could:

        • accept arbitrary auth_id
        • load stored API keys
        • forward them to attacker-controlled URLs

        2. Enforced outbound host allowlist globally Previously:

        • allowlist existed
        • but outgoingFetch() didn’t enforce it
        • plugins/engines could bypass it

        3. Fixed extension store path traversal Previously a malicious store manifest could:

        • inject … paths
        • escape install directories
        • reference arbitrary files

        4. Hardened proxy IP trust Previously:

        • rate limiting trusted any X-Forwarded-For header
        • clients could spoof their IP

        5. Fixed inconsistent settings authentication Previously:

        • settings UI stored an auth token
        • but the settings modal didn’t send it when saving

        6. Implemented Improved proxy deployment support

        • Added proxy-aware behavior:
        • DEGOOG_PUBLIC_BASE_URL for canonical URLs
        • secure cookie handling when X-Forwarded-Proto=https

        Additional Improvements:

        • suggestion fetching hardened
        • DuckDuckGo suggestion parsing fixed
        • unified outbound request handling
        • install state guard properly cleaned up

        source

        • -> View More Comments
  • Atropos@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

    Thanks, will dig into this!

    source