Skip to content

Fix accessibility kanban refresh error exposure#2242

Merged
aaronpowell merged 1 commit into
mainfrom
aaronpowell-kanban-security-fix
Jul 8, 2026
Merged

Fix accessibility kanban refresh error exposure#2242
aaronpowell merged 1 commit into
mainfrom
aaronpowell-kanban-security-fix

Conversation

@aaronpowell

Copy link
Copy Markdown
Contributor

Summary

  • replace raw refresh failure details in the accessibility kanban state with a generic user-safe message
  • clear previously persisted detailed refresh errors during state normalization so they are not re-exposed
  • keep detailed refresh diagnostics server-side via extension logging only

Testing

  • npm run build
  • npm run plugin:validate
  • npm run skill:validate
  • bash eng/fix-line-endings.sh

Stop the accessibility kanban extension from persisting raw refresh failure details to browser-visible state. Use a generic safe error message for clients, clear any previously persisted detailed refresh errors during state normalization, and keep detailed diagnostics server-side via console logging.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot AI review requested due to automatic review settings July 8, 2026 02:30
@github-actions github-actions Bot added the canvas-extension PR touches canvas extensions label Jul 8, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the Accessibility Kanban extension to avoid exposing raw refresh failure details to clients via persisted/broadcast state, while still preserving diagnostics in server-side logs.

Changes:

  • Replaces refresh failure state messaging with a single generic user-safe error string.
  • Normalizes persisted state to drop any previously-saved refresh error details (only preserving the new generic refresh error when present).
  • Adds server-side logging for refresh failures to retain diagnostics without re-exposing them via state.
Show a summary per file
File Description
extensions/accessibility-kanban/extension.mjs Introduces a generic refresh error message, logs refresh failures server-side, and clears legacy detailed refresh errors during state normalization.

Review details

  • Files reviewed: 1/1 changed files
  • Comments generated: 0
  • Review effort level: Low

@aaronpowell aaronpowell merged commit 49d020f into main Jul 8, 2026
19 of 20 checks passed
@aaronpowell aaronpowell deleted the aaronpowell-kanban-security-fix branch July 8, 2026 02:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

canvas-extension PR touches canvas extensions

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants