Repository navigation
Hotfix: image search inserts a verified, saved image - #46
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c791220ad9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| backText: card.backText, | ||
| }) | ||
| setImageSearchQuery(intent.query) | ||
| setImageSearchResultsQuery(intent.query) |
There was a problem hiding this comment.
When this dialog opens stored review candidates, this assigns a newly reconstructed default query rather than the query that produced those candidates. The image agent normally searches with styles such as clear photo isolated subject (and can use custom or revision queries), while buildImageSearchIntent here typically reconstructs clear simple illustration; selecting a stored candidate then re-runs that different query, so the API cannot find the candidate URL and returns image_selection_expired. Persist and reuse the candidates' originating query (or a server-issued selection token) so the existing “Review image options” flow remains selectable.
Useful? React with 👍 / 👎.
| }) | ||
| } | ||
| try { | ||
| const dataUrl = await embedImage(selected.url) |
There was a problem hiding this comment.
A fresh provider result is still an untrusted external URL, so it does not establish an SSRF boundary: an indexed attacker-controlled image URL can redirect to a loopback, private-network, or cloud-metadata address. embedImage explicitly uses redirect: 'follow' and performs no hostname or resolved-IP validation, allowing this new selected-image route (and its thumbnail fallback) to make the server follow that redirect. Reject private/reserved destinations after DNS resolution and validate every redirect hop before downloading.
Useful? React with 👍 / 👎.
This branch was successfully deployed
1 participant
Bug
Manual image search selection stored only a third-party URL and immediately reported success. Hotlink-blocked/expired image links left blank flashcards.
Fix
Validation
Local patch passed build and 164 primary-tree tests (exclude unrelated stale
.worktreestest discovery). GitHub branch was created on latest main; only relevant image insertion code was patched, keeping recent theme/revision features.