Conversation
Create SafeUrlValidatorService for http/https validation. Create DomainOriginVerificationService for strict iframe networking validation.
Wire bypassSecurityTrustResourceUrl inside rendered-frame.ts through the rigorous URL validator. Swap the check in preview-bridge.ts for the strict origin verification. Fix LLM concurrency in ChatCoordinator submitPrompt. Fix Monaco model.dispose() in a2ui-composer-monaco-editor. Inject takeUntilDestroyed in api-key-selector.ts and renderer-selector.ts.
Delete debug/mock-rules/ entirely. Rip out console.error patch hacks from ChatCoordinator. Delete obsolete storage key ACTIVE_DRAFT.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces several architectural improvements, including the extraction of the A2UI payload parser, error formatter, and prompt factory into dedicated services, as well as the introduction of an AbstractSelector base class for settings selectors. It also adds strict origin verification for postMessage communication and a safe URL validator service. The review feedback highlights a high-severity security issue where the origin query parameter is trusted blindly without validation against an allowlist, a potential memory leak in ChatCoordinator due to an uncleaned subscription, and the use of the deprecated String.prototype.substr method in MonacoEditor.
⚡ A2UI Composer PR PreviewYour automated preview is successfully live (commit
|
1 participant
Description
Third in a series of refactorings, intended to cleanup the A2UI Composer code.
Circular Dependency Eradication & Settings Unification
Pre-launch Checklist