Skip to content

Gaotax2006 [ Security ] validate message fields and preserve server-owned id (#8201)#8249

Open
gtx20060124-bot wants to merge 2 commits into
SecureBananaLabs:mainfrom
gtx20060124-bot:fix-8201-message-fields
Open

Gaotax2006 [ Security ] validate message fields and preserve server-owned id (#8201)#8249
gtx20060124-bot wants to merge 2 commits into
SecureBananaLabs:mainfrom
gtx20060124-bot:fix-8201-message-fields

Conversation

@gtx20060124-bot

Copy link
Copy Markdown

Fixes #8201

What's Fixed

  • sendMessage() ignores caller-supplied id, senderId, receiverId
  • Server generates unique message id (msg_*)
  • Server-owned fields preserved

Changes

  • apps/api/src/services/messageService.js — destructure out server-owned fields

Gaotax2006 and others added 2 commits June 22, 2026 12:24
- @freelanceflow/ui: Add proper exports field with ESM/CJS/types entrypoints
- @freelanceflow/ui: Add build script, types, peer deps for react
- @freelanceflow/db: Add exports field for workspace entrypoint
- Fixes SecureBananaLabs#2781 (@freelanceflow/ui package entrypoint should be directly importable)
- Fixes SecureBananaLabs#2775 (@freelanceflow/db package should expose an importable workspace entrypoint)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
github-actions Bot added a commit that referenced this pull request Jun 22, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Message creation should validate required fields and preserve server-owned ids

1 participant