- Enhanced URL sanitization in Thumbnails component to prevent XSS and redirect attacks
- Added comprehensive validation for data: URLs including dangerous patterns
- Added length limit (5MB) for data URIs to prevent DoS
- Fixed handleImageClick to use sanitized URL instead of original
- Added explicit rejection of javascript:, vbscript:, and other dangerous protocols
- Restrict URL validation to only allow data:image/ URIs with proper base64 format
- Remove support for HTTP/HTTPS URLs as backend openImage() only supports data URIs
- Add regex validation for proper data URI format (data:image/[type];base64,)
- Eliminates both XSS and URL redirect vulnerabilities by design
- Maintains backward compatibility as codebase only uses data:image/ URIs
Add support for the save/discard flow for support prompt setting page
Normally when you edit things on the settings pages, the save button lights up,
allowing you to discard your changes. Currently the prompts page doesn't support this flow-
the prompts are immediately saved when they change.
With this change, we use the normal cachedState system in the SettingView, allowing users to dicard changes to their prompts like any other setting.
This removed the need for the resetSupportPrompt event since we send the entire state of the support prompts (same as before).
Test plan:
* Manually verified prompts can be saved/discarded for different types of support prompts.
* Add reasoning budget support to Bedrock models and update related components
- Introduced `supportsReasoningBudget` property in Bedrock models.
- Enhanced `AwsBedrockHandler` to handle reasoning budget in payloads.
- Updated `ThinkingBudget` component to dynamically set max tokens based on reasoning support.
- Modified `ApiOptions` and `Bedrock` components to conditionally render `ThinkingBudget`.
- Added tests for extended thinking functionality in `bedrock-reasoning.test.ts`.
* Add BedrockThinkingConfig interface and update payload structure
* fix: address PR review feedback (#4481)
- Simplify ThinkingBudget ternary logic since component only renders when reasoning budget supported
- Break down complex thinking enabled condition with clear documentation
- Replace 'as any' usage with proper TypeScript interfaces for AWS SDK events
- Add comprehensive documentation for multiple stream structures explaining AWS SDK compatibility
* feat: show ThinkingBudget component unconditionally
Remove selectedProviderModels.length check to display ThinkingBudget
for all providers, not just those with available models
---------
Co-authored-by: hannesrudolph <hrudolph@gmail.com>
