Jakob WennbergandClaude Opus 5
2da96c0be2
* fix(agent): stop sending every page view to a third-party avatar CDN Eight avatar SVGs were loaded from api.dicebear.com on every render. In an accounting product that meant every authenticated page view told a third party who was looking at it, from a domain we do not control, on the path of a logged-in surface. A firewalled or self-hosted install showed no faces at all. The SVGs are now generated once and served from public/agent-avatars. Each entry records the seed it came from, so the set can be regenerated reproducibly, and the command to do it is in the file. The licence question that made this look like a founder decision resolved itself on inspection: Notionists is by Zoish under CC0 1.0, public domain, no attribution required. Confirmed on dicebear.com/licenses and, more usefully, in each downloaded file's own RDF metadata, so the terms travel with the asset rather than living in a commit message. Tests pin the properties that matter rather than the file list: no entry may be a remote URL, every entry must have a file behind it, and no shipped SVG may carry an <image href>, a url(https://…), an xlink:href or a <script>, since self-hosting a file that then phones home would reintroduce exactly the request this removes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * test(agent): assert the property, not a list of elements, for avatar externals The external-reference check enumerated <image href>, url(https://…) and xlink:href, which left <use href>, <feImage href> and scheme-relative //host through: exactly the requests the guard claims to prevent, via elements it happened not to list. That is how this sort of allowlist rots. It now strips the parts that legitimately carry URLs and are never fetched (the RDF metadata block, xmlns declarations) and then asserts that NOTHING in what remains points off-origin. Verified by injecting each of the four bypasses into a real asset and confirming the test fails on all of them. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
1 line
11 KiB
XML
1 line
11 KiB
XML
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1744 1744" fill="none" shape-rendering="auto"><metadata xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:dcterms="http://purl.org/dc/terms/"><rdf:RDF><rdf:Description><dc:title>Notionists</dc:title><dc:creator>Zoish</dc:creator><dc:source xsi:type="dcterms:URI">https://heyzoish.gumroad.com/l/notionists</dc:source><dcterms:license xsi:type="dcterms:URI">https://creativecommons.org/publicdomain/zero/1.0/</dcterms:license><dc:rights>Remix of „Notionists” (https://heyzoish.gumroad.com/l/notionists) by „Zoish”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)</dc:rights></rdf:Description></rdf:RDF></metadata><mask id="viewboxMask"><rect width="1744" height="1744" rx="872" ry="872" x="0" y="0" fill="#fff" /></mask><g mask="url(#viewboxMask)"><rect fill="#f5f3ed" width="1744" height="1744" x="0" y="0" /><g transform="translate(531 487)"><path d="M554 727.7c-99.2 297-363.8 388.6-503.7 19.8-19.3-50.7 31-69.5 66.2-91.9 24.1-15.3 36.8-28.5 35.3-42.2-7-64.4-36.9-243.8-36.9-243.8l-3-5.8s.7-1.6-2.2 1.2c-3 3-9.9 34.2-37 34.2-24.5 0-49.2-10.9-61-86.3C7.2 285.6 9.6 214 40 201c12.5-5.3 24-7.2 35.2-.8 11.3 6.4-13-22 112-126C268.4 6.4 396.7-3.5 448.5 8 500.3 19.5 552 44.8 574.9 98.5c27.8 65-25.9 114.3-14 262.5-2.2 53.6.8 171.2-146.6 210.6-28 7.5-19.3 48.4 22.7 58.4 67 21 117 72.3 117 97.9" fill="#fff"/><path fill-rule="evenodd" clip-rule="evenodd" d="m554 266.2.1-1.4c4.1-36.4 8.2-71.7 27.1-103.4 6.5 4.4 5.7 10 3.7 15.2-19.9 51.2-18 104.4-16.2 157.6l.4 14c2.1 66.4-14.5 126.8-58.7 177.5-15.4 17.6-35.8 29.8-56.5 40.3-21.4 11-25.9 20.1-19.2 43.6l.8 2.6c1.4 3.9 2.8 7.9-1 11.8-4.5 4.6-9.5 3.3-14.8 1.8l-.6-.1a406.4 406.4 0 0 1-137-68.3c-6-4.4-10.8-10.3-15.5-16.1l-.3-.4c-2.5-3-3-7.8.5-10.4 3.3-2.5 5.8-.5 8.7 1.8l1 .9a145.5 145.5 0 0 0 76.3 31.7c13.4 1.4 26.6.9 40 .4 7.4-.3 14.8-.6 22.3-.5 10.2 0 18.7-4.7 26.7-9.2l2.8-1.6c27.8-15.5 54.3-32.8 72.2-60.7 16.1-25 25.9-52.2 31.6-80.9 7.2-36.1 6.6-72.7 6-109.8-.3-12-.5-24.2-.5-36.4ZM50.6 190.8c21.9-1.7 34 11.2 44.3 26.3a140.4 140.4 0 0 1 22.4 61.5c.5 3.7 1 7.6-1.2 11.3-4.5.6-4.9-3-5-5.6-.5-20.7-9.7-38.7-18.9-56.1-6.6-12.5-16.2-24.6-31.4-27.6-17.2-3.5-33 12-40.8 32.2-14.5 37.6-12 74.6 1.4 111 5.8 15.9 13.1 32.1 27.8 43.2 14.8 11.3 32.7 9.3 43.6-5.7l2-2.5c2-2.6 4-5.1 5-8 2.1-5.8 5.4-11.2 11.3-10.4 6.8 1 8 8.3 8.7 14a3661 3661 0 0 0 22 156.7l5.9 38.8c2.6 17.1 5.6 41.7 3.6 52.1a28 28 0 0 0-.3 2.2c-.4 2.8-.6 5-4.2 5.5-4.9.8-7-2-7.7-6.4-2.3-17-3-23.6-4-49.6-.9-25.2-5.6-50-10.4-74.9l-5-27c-5.2-30.8-10.3-62-10.8-97l-2 3c-7.6 11.3-13.7 20.5-24.5 24a40.5 40.5 0 0 1-46.1-12.5 127.8 127.8 0 0 1-28.8-55.8c-8.4-34-9.9-67.1.9-100.6 5.2-16.1 23.7-44.7 42.2-42Zm34.6 127.5c4.4 3.2 8.4 6 12-5.4-1.1-42.2-14.7-69.2-35.8-70.3 11.2 14.6 22 28.8 23 48.5a32.3 32.3 0 0 1-10.7-8.8c-2-2.2-4-4.4-6.5-6l-3-2.4c-4.8-3.6-9.7-7.4-17.8-4.5 3.8 5.8 9 10 14.3 14 6 4.7 12 9.3 15.6 16.5-10.6 7.7-15.2 17.7-9.7 29.9 4.8 10.5 11.9 19.2 25.9 19.8-.6-6.3-4.7-10.9-8.8-15.4-5-5.4-9.7-10.6-7.5-18.6 3.2-1.5 6.2.7 9 2.7Z" fill="#000"/></g><g transform="translate(178 1057)"><path d="M1291.6 689H83.2l8.6-63.3S14.2 599.3 6.5 584c-7.8-15.3 84.1-214.2 96.7-245.6 12.7-31.5 77-142.8 115.1-164C260.7 150.6 400 87.5 408 81.1c26.1-21 82.7-42.8 82.7-42.8V69l171.4 281 10.3 37.8S776 107 785.7 50C793.9 2 905.5 60.2 905.5 60.2s114.1 70.6 143 93.3c58.4 46.2 140 138.6 180.7 239.2 23.2 57 72.5 168.2 80.6 181.3 8.1 13-27 36-27 36l8.8 79.1Z" fill="#fff"/><path fill-rule="evenodd" clip-rule="evenodd" d="M1044.5 160c-24.1-19.9-48.3-39.8-75-55.2-4-2.2-7.8-4.6-11.7-7-13.2-7.8-26.4-15.8-41.4-20.6-1.8 10.2-1.4 20-.5 29.6A699 699 0 0 1 916 248c-1.4 11.5-1.1 23.3-.8 35l.2 12.3c0 6.8-1 13.6-2.7 20-2.4 9.2-6.7 13.3-16 14-8.3.6-16.6 1.9-24.8 3.2a187.8 187.8 0 0 1-40.3 3.4c-2.8-.2-5.6-.1-7.3 0H823l3.5 4.4c3.2 4 7 8.7 10.4 13.6 5.5 7.7 6.7 14.4 1.5 24.9-26 52.4-61 97.3-98.6 138.3-12 13.1-23.4 27.2-34.7 41.2-18.7 23.3-37.4 46.6-59.8 65.8-11.3 9.7-21.5 20.8-31.8 32a403.9 403.9 0 0 1-31.7 32.1c-13.3.7-26.2.7-40.2.7 6.4-12.8 11.6-26.5 16.8-40.2a497 497 0 0 1 15-36.4 858.8 858.8 0 0 0 26.7-64.4c6-16 6.3-32.2-4.2-46.8l-11.4-16c-20.4-28.5-40.9-57-64.2-82.7-10.6-11.6-13-30-6.3-47 1.7-4.2 3.2-8.5 4.8-12.9l2.1-5.8c-14-6-28-6.3-42.1-6.7-6.7 0-13.3-.2-19.8-1l-1.4-.2c-21.6-2.4-22-2.5-29.6-26.2a699.8 699.8 0 0 1-31.6-157 134.6 134.6 0 0 0-9.9-43.4c-22.8 9.3-44.6 19.8-66.3 30.3l-1 .4c-24.7 12-49.2 24.9-73.5 38.1-36 19.8-64.1 49.8-87 86.6l-.5.8c-16.7 26.8-33.3 53.6-46.4 83L88 394.4l-13.3 29.3-10.5 23.1c-9.2 20.2-18.4 40.3-27 60.7a795.9 795.9 0 0 0-20.4 52.4c-4 11.7-.1 17 8.3 20l15 6a206 206 0 0 0 43.3 13.8c20 3.2 38 11.5 56 19.8l1.3.6 1.4.6c30.3 14 60 29.3 89.8 44.7a360.8 360.8 0 0 1 36.6 22.7c-9.6.8-19.2 1-28.8.3a620 620 0 0 0-80.9-37.3c-19.4-7.8-38.8-15.6-58-25a565 565 0 0 1-4.6 21.6C93 662 90 675.2 89.6 689H77c-2.2-7.2-.6-14 .9-20.8l1.2-5.5c2-11.3 1.2-19.7-11.4-22.1-18.5-3.7-34-14.8-49.6-25.9a1279 1279 0 0 0-5-3.5c-12-8.5-15.8-26.2-11.2-47 5.2-23.5 14.4-45 23.7-66.5l1.3-3c16.3-38 33.2-75.5 50.2-113l13.4-29.8c25.7-57.1 55.5-112 97.5-156.4 21-22.2 45-38.9 71.7-51.8 7.8-3.7 15.6-7.6 23.4-11.5 20-10 40-20 60.5-28.2 19.3-7.6 28-17 36.4-26.3 9-9.7 17.8-19.3 38.6-26.2l13.9-4.8c16.8-6 33.6-11.8 51.4-13.5h1c1.3-.1 2.6-.2 3.4-1l.3-.3c4-4 8.3-8 13-1.6a17.5 17.5 0 0 1 1 19.2c-7 10.8-3.2 21 .3 30.4l.3.9c8.4 22 60.2 109.5 78.7 134.6l6 7.9c21 28 72.4 96.4 87.9 143.7 6.2-12.1 10.6-25 14.9-37.7l5.2-15a2199 2199 0 0 0 29.2-86.7c3.7-11.5 7-23 10.2-34.7 2.7-9.4 5.3-18.8 8.2-28 4.3-14.2 8.8-28.2 13.3-42.2l9-28.2 5.9-19.2 6.5-21.5c8.3-25.8 10.4-30.5 34-29.7 29.2 1 63.6 11.3 83.6 19.7 96 40.4 248.5 140.6 319.7 290.2a2276 2276 0 0 1 59.5 140.3c17.5 44 31.2 78.6 42.6 95 9.6 14 8.5 22-4 32.1a92.1 92.1 0 0 0-4.7 4.1c-4 3.7-8 7.4-13.2 9-5.6 1.7-7.3 6.5-6.5 13a2842 2842 0 0 1 6.5 60.4c-4.1 1-8 1-13.3.1-4-9.2-3.8-18-3.6-26.5v-1c.5-15.5-3.5-29.7-7.7-44.6l-3-10.9c-3.3 1.4-6.6 2.7-10 3.9-7 2.6-13.7 5.1-20 8.8a252.2 252.2 0 0 1-76 30.5c-20.9 4.4-30.5 17.1-27.6 40.8-5 .1-10.1-.3-15.1-1.2-2-41.7 23.2-51.6 55.8-64.4l11.7-4.7c47.4-19.5 108-47.2 108-47.2s-61.1-143.9-82.6-198.2c-42-106.6-147.6-196.7-151.1-199.5l-16.7-13.7ZM729.3 261.3a2651.4 2651.4 0 0 1-51.6 140.5c-14 35.6-29.2 70.6-44.4 105.5l-1.5 3.6c-5.5 12.4-10.6 25-15.7 37.5-7.5 18.2-15 36.5-23.2 54.3-6.7 14.4-12.5 29.3-18.3 44.3l-8 20.4-.5 1.2c-1.2 2.7-2.4 5.4.4 8 2.1 2 4.4.5 6.2-1 2.4-2 4.8-4.1 7-6.4l13-13.5 18.4-19 19.5-19.6c10.6-10.6 21.2-21.1 31.6-32 7.5-7.8 14-16.7 20.5-25.6 7-9.5 14-19 22-27a560 560 0 0 0 58.8-68c6.2-8.5 12.7-16.8 19.2-25.1 14.3-18.5 28.6-37 40.1-58.1 5.2-9.5 6.4-16.1-2.4-23.8-6.7-6-12.3-13.6-17.8-21l-.7-1-.4-.5c-3-4.2-6.6-9-3.2-15.7 7.4-1 14.9-1.3 22.4-1.2 21 0 42-.8 63-1.6l3.7-.1c7.2-.3 11.9-4.4 12.2-13.4a1433.4 1433.4 0 0 1 1.8-34.5l1.5-25c1.8-28.5 3.6-57 2.5-85.5-1-24.3-1.4-48.7-.1-73 .7-12-3.3-17.6-11.7-22.9-23.6-14.8-49.5-18.3-75.4-21.9l-11.6-1.6c-6.6-1-8.8 3.4-10.5 8.8-1.6 5.2-3.5 10.4-5.3 15.6-2.8 7.7-5.6 15.5-7.6 23.6-3.3 13.4-8 26.2-12.7 39-2.8 7.6-5.6 15.3-8.1 23-4.6 14.4-8.7 29-12.8 43.8-5.9 21-11.8 42.5-19.6 63.9a28 28 0 0 1-.7 5Zm-240.7-172 .5 1.2C505.6 127.3 585.3 247.1 617 291l4.5 6.2c16.5 22.3 46.3 62.7 38 95.6a486 486 0 0 1-34 96c-.9 1.9-1.5 4-2.2 6.1a23.7 23.7 0 0 1-6.3 11.8c-13-22-28.3-42-43.6-61.9-6.9-9-13.8-18-20.5-27.2-4.8-6.6-10.2-12.6-15.5-18.7-4.5-5-9-10-13.1-15.4-5.1-6.6-4.6-10.9-1.4-16.3 3.5-5.9 5.7-12.4 8-18.9l1.8-5.4c4.7-13 1.5-19.8-10.8-23.7-8.5-2.6-17.2-2.7-25.9-2.7-5.6 0-11.2 0-16.7-.8-.6 0-1.3 0-2 .2l-1.4.2c-27.8.5-30.2-2-39.1-30.8A625.2 625.2 0 0 1 412 162.6c-1-8.8-2.6-17.4-4.2-26-1.5-7.6-3-15.1-3.9-22.8-2-15.8.5-21.5 13.3-27 14.6-6.3 19.1-12.7 23.2-18.5 4.6-6.5 8.7-12.3 25.8-16.6h.2c13.3-3.4 14.2-3.7 14.8 12.4.3 9.3 4 17.5 7.4 25.1Z" fill="#000"/></g><g transform="translate(266 207)"><path d="M906.2 370.6c6 27.1 12 53.2 10.8 80.4-1.2 29 5 57.4 8.2 86.1 3.8 33 13 66.4 2 99.7-6.2 18.6-18.2 33-37.9 46.3V624c-3.7 40.6-8 79.4-51.3 100.5-8.2-12.8-4-25.7-4.1-37.4-.6-46.9-9.8-93-10.5-139.8-.4-21.5 3.2-42.4 8-63.1.1-.9.6-1.6.8-2.4 2.3-12 2.4-20.8-11.5-29a260.2 260.2 0 0 1-90.9-90c-50.7 35.8-106 49.9-166.4 37-15.4 30.1-38.6 52.4-62 74.8a654.1 654.1 0 0 1-83.8 66.4c-5.5 3.7-11.3 8.5-12.2 15.8-1 8.3-6.4 10.9-13.2 10.6-7.2-.2-12.5-3.5-14.7-11.5-4.6-16.4-10.3-32.4-15-48.7-3.9-13-13-21.6-22.8-29.7-11.4-9.5-33.5-4.9-44.4 9a91 91 0 0 0-17.7 45.6 172.3 172.3 0 0 0 29.6 123.4c21.5 30.5 43 20.4 59.5-4 3.8-5.4 6.6-11.5 12.8-15.5 7 5.3 7 12.7 7.2 19.6.8 18.3-.6 36.6 2.2 54.9 1.3 8 2 17.7-11 18.9-20.7 1.8-26.1-1-28.2-16-.6-4-.5-8.3-.7-12.8-.7.8-1.6 1.4-1.8 2-4.8 23-15.6 27.4-43.4 16.8-7.2-2.7-13.8-6.6-20.8-9.8-6.5-3-7.3-8.8-8-15-.6-5.7 1.4-11.7-1.7-18.2-3.3 5.7.9 14.1-7 16.5-7.8 2.4-12.9-3.5-18.3-7.3a70 70 0 0 1-20.9-25.2c-20.2-37-35.5-75.6-33.6-118.5 1.4-32.8 11-63 34.5-87.9 15.1-16 25.5-36 29.8-57.6C271.9 328.5 314.3 284 375 253.6c37.8-18.9 78.5-32.4 113.6-56.2 26.6-18.1 54.2-33.8 84.7-43C624.2 139.4 674.5 138 725 160c39.5 17.1 62 46.7 75.7 85.1 2.2 6.2 5.7 9.3 11 11 49 16.4 72.2 55.6 89 100.5 1.5 4.4 3.4 8.7 5.4 14Z" fill="#000"/></g><g transform="translate(791 871)"><path d="M182.3 95.7c-29.2 14-65.1 3-84.2-16-2.3-2.3-3.8-5.6-5.3-8.6-1-2.3-1.6-5 .7-7.1 2.2-2.1 4.7-1.8 7.1-.7 2.6 1.3 5.6 2.5 7.5 4.5 12.1 13 28 16.4 44.7 19C162 88 169 82.3 177 80.2c5.3-1.4 11-9 15-.7 3.3 6.8-1.3 12.9-9.7 16ZM66.6 57.4C71 45.2 80.3 40.6 90.8 37.9c5-1.3 10.8-1.7 13 4.3 2.4 7-3.2 10.9-8.3 12-7.3 1.4-12 4.6-15.4 11.2-2.2 4.3-5.7 9.7-11.7 7-7.2-3-3.8-9-1.8-15Z" fill="#000"/></g><g transform="translate(653 805)"></g><g transform="translate(901 668)"><path d="M45.4 194.6c-5 .2-8.7-.4-12-2.9-2.8-2-3.2-4.8-2.6-7.9.5-3.3 3.2-3.8 5.8-3.6 14.1.7 28-.5 41.1-6.4 3.2-1.5 6-.2 7.7 2.6 1.7 3.1 2 6.3-.8 9.4-5 5.8-11.2 9-19 8.8H45.5Z" fill="#000"/></g><g transform="translate(610 680)"><path d="M407.4 122.5c13 .3 25.4 1.1 37.6 2.5 3 .4 5 3.3 5 6.7 0 3.3-1.7 5.6-4.7 7-11.2 4.8-22 8.2-33.7.2-6.5-4.5-9-8.7-4.2-16.4ZM247.6 117c7 0 7.8 3.8 7 8.5-2 10.2-20 22.4-30.4 20.5-5.9-1-10.5-4-10.7-10.5-.2-6.7 4.8-8.2 10.3-8.4 9-.3 15.8-5.2 23.8-10ZM215.1 76.6c5-12 9-29.4 24.1-22.5 20.7 9.4 13.9 30.7 9.7 47.4-1.6 6.3-14.5 15.9-18.3 14.3-16.3-6.8-19.2-21.7-15.5-39.2ZM442 113.4c-8.6 7.5-17 7.6-22.2-1.5-9-16-8.6-32.8 3.3-47.2 2.5-3 13.8-3.6 16.3-1 14 15 14.6 31.8 2.6 49.7Z" fill="#000"/></g><g transform="translate(610 680)"></g><g transform="translate(774 657)"><path d="M30.3 32.1C58 10 89.8 13.1 121 14.1c5.7 0 12.2 1.3 14.3 8.3 2.1 7.7-4.6 9.9-8.8 13.8a44.7 44.7 0 0 1-52.2 8.6 37.9 37.9 0 0 0-31.9 1.6c-2 1-3.8 1.9-5.8 2.6-6.3 2.5-14.3 6-18.6-.4-4.4-6.7 5.6-9 8.3-13.7.6-1 2-1.6 3.9-2.8ZM294.4 23.8c7.7 4.3 14.5 10 20 17 2.5 3 5 6.3 3 10.2-2.4 4.3-6.7 2.7-10.4 2.2-12.5-1.5-23.7-9.2-37-7.2-5 .8-9.9.7-15 2.5-13 4.7-31-6.4-33-19.8-1-5.4 1-8.5 6.8-10 22.2-5.7 44-9 65.6 5.1Z" fill="#000"/></g><g transform="translate(0 559)"></g></g></svg> |