Jakob WennbergandClaude Opus 5
2da96c0be2
* fix(agent): stop sending every page view to a third-party avatar CDN Eight avatar SVGs were loaded from api.dicebear.com on every render. In an accounting product that meant every authenticated page view told a third party who was looking at it, from a domain we do not control, on the path of a logged-in surface. A firewalled or self-hosted install showed no faces at all. The SVGs are now generated once and served from public/agent-avatars. Each entry records the seed it came from, so the set can be regenerated reproducibly, and the command to do it is in the file. The licence question that made this look like a founder decision resolved itself on inspection: Notionists is by Zoish under CC0 1.0, public domain, no attribution required. Confirmed on dicebear.com/licenses and, more usefully, in each downloaded file's own RDF metadata, so the terms travel with the asset rather than living in a commit message. Tests pin the properties that matter rather than the file list: no entry may be a remote URL, every entry must have a file behind it, and no shipped SVG may carry an <image href>, a url(https://…), an xlink:href or a <script>, since self-hosting a file that then phones home would reintroduce exactly the request this removes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * test(agent): assert the property, not a list of elements, for avatar externals The external-reference check enumerated <image href>, url(https://…) and xlink:href, which left <use href>, <feImage href> and scheme-relative //host through: exactly the requests the guard claims to prevent, via elements it happened not to list. That is how this sort of allowlist rots. It now strips the parts that legitimately carry URLs and are never fetched (the RDF metadata block, xmlns declarations) and then asserts that NOTHING in what remains points off-origin. Verified by injecting each of the four bypasses into a real asset and confirming the test fails on all of them. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
1 line
11 KiB
XML
1 line
11 KiB
XML
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1744 1744" fill="none" shape-rendering="auto"><metadata xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:dcterms="http://purl.org/dc/terms/"><rdf:RDF><rdf:Description><dc:title>Notionists</dc:title><dc:creator>Zoish</dc:creator><dc:source xsi:type="dcterms:URI">https://heyzoish.gumroad.com/l/notionists</dc:source><dcterms:license xsi:type="dcterms:URI">https://creativecommons.org/publicdomain/zero/1.0/</dcterms:license><dc:rights>Remix of „Notionists” (https://heyzoish.gumroad.com/l/notionists) by „Zoish”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)</dc:rights></rdf:Description></rdf:RDF></metadata><mask id="viewboxMask"><rect width="1744" height="1744" rx="872" ry="872" x="0" y="0" fill="#fff" /></mask><g mask="url(#viewboxMask)"><rect fill="#f5f3ed" width="1744" height="1744" x="0" y="0" /><g transform="translate(531 487)"><path d="M554 727.7c-99.2 297-363.8 388.6-503.7 19.8-19.3-50.7 31-69.5 66.2-91.9 24.1-15.3 36.8-28.5 35.3-42.2-7-64.4-36.9-243.8-36.9-243.8l-3-5.8s.7-1.6-2.2 1.2c-3 3-9.9 34.2-37 34.2-24.5 0-49.2-10.9-61-86.3C7.2 285.6 9.6 214 40 201c12.5-5.3 24-7.2 35.2-.8 11.3 6.4-13-22 112-126C268.4 6.4 396.7-3.5 448.5 8 500.3 19.5 552 44.8 574.9 98.5c27.8 65-25.9 114.3-14 262.5-2.2 53.6.8 171.2-146.6 210.6-28 7.5-19.3 48.4 22.7 58.4 67 21 117 72.3 117 97.9" fill="#fff"/><path fill-rule="evenodd" clip-rule="evenodd" d="m554 266.2.1-1.4c4.1-36.4 8.2-71.7 27.1-103.4 6.5 4.4 5.7 10 3.7 15.2-19.9 51.2-18 104.4-16.2 157.6l.4 14c2.1 66.4-14.5 126.8-58.7 177.5-15.4 17.6-35.8 29.8-56.5 40.3-21.4 11-25.9 20.1-19.2 43.6l.8 2.6c1.4 3.9 2.8 7.9-1 11.8-4.5 4.6-9.5 3.3-14.8 1.8l-.6-.1a406.4 406.4 0 0 1-137-68.3c-6-4.4-10.8-10.3-15.5-16.1l-.3-.4c-2.5-3-3-7.8.5-10.4 3.3-2.5 5.8-.5 8.7 1.8l1 .9a145.5 145.5 0 0 0 76.3 31.7c13.4 1.4 26.6.9 40 .4 7.4-.3 14.8-.6 22.3-.5 10.2 0 18.7-4.7 26.7-9.2l2.8-1.6c27.8-15.5 54.3-32.8 72.2-60.7 16.1-25 25.9-52.2 31.6-80.9 7.2-36.1 6.6-72.7 6-109.8-.3-12-.5-24.2-.5-36.4ZM50.6 190.8c21.9-1.7 34 11.2 44.3 26.3a140.4 140.4 0 0 1 22.4 61.5c.5 3.7 1 7.6-1.2 11.3-4.5.6-4.9-3-5-5.6-.5-20.7-9.7-38.7-18.9-56.1-6.6-12.5-16.2-24.6-31.4-27.6-17.2-3.5-33 12-40.8 32.2-14.5 37.6-12 74.6 1.4 111 5.8 15.9 13.1 32.1 27.8 43.2 14.8 11.3 32.7 9.3 43.6-5.7l2-2.5c2-2.6 4-5.1 5-8 2.1-5.8 5.4-11.2 11.3-10.4 6.8 1 8 8.3 8.7 14a3661 3661 0 0 0 22 156.7l5.9 38.8c2.6 17.1 5.6 41.7 3.6 52.1a28 28 0 0 0-.3 2.2c-.4 2.8-.6 5-4.2 5.5-4.9.8-7-2-7.7-6.4-2.3-17-3-23.6-4-49.6-.9-25.2-5.6-50-10.4-74.9l-5-27c-5.2-30.8-10.3-62-10.8-97l-2 3c-7.6 11.3-13.7 20.5-24.5 24a40.5 40.5 0 0 1-46.1-12.5 127.8 127.8 0 0 1-28.8-55.8c-8.4-34-9.9-67.1.9-100.6 5.2-16.1 23.7-44.7 42.2-42Zm34.6 127.5c4.4 3.2 8.4 6 12-5.4-1.1-42.2-14.7-69.2-35.8-70.3 11.2 14.6 22 28.8 23 48.5a32.3 32.3 0 0 1-10.7-8.8c-2-2.2-4-4.4-6.5-6l-3-2.4c-4.8-3.6-9.7-7.4-17.8-4.5 3.8 5.8 9 10 14.3 14 6 4.7 12 9.3 15.6 16.5-10.6 7.7-15.2 17.7-9.7 29.9 4.8 10.5 11.9 19.2 25.9 19.8-.6-6.3-4.7-10.9-8.8-15.4-5-5.4-9.7-10.6-7.5-18.6 3.2-1.5 6.2.7 9 2.7Z" fill="#000"/></g><g transform="translate(178 1057)"><path d="M1313.4 698 9.7 694.7S43.1 485 106 365.7c17-32.4 81-128.7 141.8-189.6 40.8-41 87.7-56 89-62 2.2-9.7-11-41.4-8.8-48.5 8.1-25.5 9.5.8 42.1-31.8 18.3-18.2 1.4-29.6 21.6-43.2 29.8-20 60-8.7 87-7.6 18 .7 12.4 50.3 27.3 62.5 40.3 32.9 91.8 54 128 63.5 46.1 12.2 61.6-2.5 85.4-12.2 23.8-9.6 38.5 12.2 68.9-33.2 14.2-21.2-11-42.6 8.2-54C826.6-8.3 872.2-7.7 891.1 2c28.9 14.8 16.3 41.6 16.3 41.6s35.7 11.6 43 22c7.2 10 5 44 5 44s-2.8-13.7 63.4 23.5c84.2 47.4 179.2 187.2 223 296 46.6 115.8 71.6 269 71.6 269Z" fill="#fff"/><path d="M1307 698c-9.4-38.5-16.9-77.2-25.6-115.7-6.3-27.8-14-55-22.4-82.2-9.5-30.6-19.5-61-33-90.4-9.6-20.7-19.4-41.1-29.5-61.5a673 673 0 0 0-57.7-92.4 470.2 470.2 0 0 0-60.5-70 342.9 342.9 0 0 0-83-57.4c-3-1.5-6.6-2.3-9.2-4.3-17-12.7-33.7-6.3-44.8 12.9-30.8 53.2-78.6 77.6-137.2 85.4a19 19 0 0 1-6.4 0c-5.6-1.2-13.6-1.2-13-9.1.7-7 8-4.5 12.7-5.1 43.7-5.8 84-19.6 113.4-54.3 12.4-14.8 21.6-32.4 31.3-49.3 10.2-17.9 2.4-45-23.7-50.5-11.8-2.5-19.5-6.3-16.2-21.4 2-9.6-4.8-18.9-13.2-23-10.4-5-21.7-9.1-34.5-5.6-11.7 3.2-24.2 4.1-36.3 6-7.1 1-12.2 5.8-18 9.4-4.4 2.8-4.4 6.4-2.5 11 7 17.4 1 39.8-13.9 51-14.7 11.2-30.4 20.2-50 18.4-4.9-.5-8.9 1.2-12.8 4.4-14 11.8-30.4 14.5-48.7 14.3-38.8-.4-74.2-12.6-109.2-27.3-7.8-3.3-13.6-12.6-26.5-7.5 27 34.9 67 48.4 105.6 67.6a26 26 0 0 1-24.8 3c-51.4-17.5-91.9-47.6-117.2-97-8.4-16.5-14.9-33-18.1-51-2.3-12.6-5.7-13.8-17.6-8.4-13.2 6-24.9 14.3-35.7 23.6-12.5 10.8-20 24-18.1 41.5 1 8.4 0 17 .2 25.6a47.3 47.3 0 0 0 35.2 46 37 37 0 0 1 18.4 10.8c-14.6 6.6-40.5-1.2-53-15.9C377.8 89.8 391.1 21 437.3-3.2l5-2.8a39.9 39.9 0 0 0-54 19A80.5 80.5 0 0 1 349 56c-15.3 7.7-19.8 28.7-7.8 39.4 23.4 20.8 43 45.8 69.9 62.6 15.4 9.6 30.1 21 46.7 28 15.8 6.5 33.6 8.4 50.6 11.8 5 1 10.2.8 13.3 5.6.3 3.4-1.7 5.6-4.4 5.5-32.1-1.5-63.4-4.4-92-23a437.5 437.5 0 0 1-69-54.1c-11-11-23.1-6.1-34 0-39 22-72.5 50.9-102.9 83.7a615.2 615.2 0 0 0-87.4 123 870.6 870.6 0 0 0-50.5 108A1198.4 1198.4 0 0 0 47 548.6a558.2 558.2 0 0 0-20.6 102.1c-1.3 15.2-7.3 29.7-7.9 46.2-5.5 1-10.8 1-17.1 1 4.6-32.9 9.9-66 16.2-98.8 3.7-19.1 9.2-37.9 13.7-56.8 5.6-23.6 13.4-46.5 21.2-69.4a831.6 831.6 0 0 1 84-179c16.9-27 36-52.4 57-76 36.7-41.1 76.3-78 126-103 6.4-3.3 9.3-7 4.1-15.1C314.4 85 317.8 54 339 44.4c16.6-7.6 26.6-22 34.3-37.8a56.1 56.1 0 0 1 51.4-33.3c19.6-.5 39.2-.7 58.8-1 9 0 14.1 1.6 10.1 12.7C491.1-8 492-.5 499 4.5a8.7 8.7 0 0 1 4 6.1c4.4 31 27.1 45.6 52.1 57.7 19.8 9.6 39.6 20.3 60.5 26.3 21.8 6.3 44.5 12.1 67.7 10.5a46 46 0 0 0 26.9-10.8c6.3-5.4 14.2-4.9 21.6-6.4 17-3.4 32.5-9.8 45-22.1 11.2-11.2 12-22 3.3-35.3-7.8-11.9-3.3-33.8 8.5-40.8 3.5-2 8.7-2.8 9.8 1.6 3 11.4 9.8 6.6 15.9 4.8a159 159 0 0 1 55.3-8.2A58 58 0 0 1 906 3.5c7.8 6.9 9.7 15.6 9.8 25.3 0 7.6 2.4 11.9 11 13.9 24.7 5.6 33.8 17.7 34.2 43.1 0 5.3 1.4 8.3 6.3 11 34.6 18.7 70.4 35.4 101.6 60 29.3 23 53 51.1 75.5 80.4A719.4 719.4 0 0 1 1245 414c18.2 46.5 33.7 94 46.4 142.4 12 46 16 93.5 27.1 140.6-3.2.9-6.7.9-11.4.9Z" fill="#000"/><path d="M1122.7 698c-9.3-36.4-12.3-73.8-22.2-110-7.8-28.4-14-57.4-24.2-85-7.2-19.4-14-39-23.5-57.7-12.7-25-23.3-51.2-34.7-77-1.4-3-2.8-6.3 1.4-8.8 4.4-2.7 7.6-.6 9.9 2.7 5 7.3 10.2 14.6 14.2 22.5 16 31.2 32 62.7 43 96 7.5 22.8 15.6 45.5 21.2 69 3.9 16.5 8.2 33 12 49.4 7 32.2 11.9 65 14.5 97.9-3.4 1-7 1-11.6 1ZM219 698a451 451 0 0 1 4.4-86.5c3.7-29 4.4-58.3 11-87 3.9-17 9-33.6 13-50.4 7.4-32.1 18.1-63.5 34.6-92.4 2.4-4 4.8-8 7.4-12 2.3-3.3 4.1-8.7 9.5-6.2 5.7 2.8 3.2 8.2 1.8 12.4a320 320 0 0 1-10 26.1c-18 40-33 81.2-40.6 124-7.3 42-15.8 84.3-14 127.6.7 14-1.6 28-2.6 43.2-4.5 1.2-9 1.2-14.4 1.2ZM629.3 367.8c-1.5-9.8 2.8-16.7 6.6-23.9 11.4-21.3 8.4-29.9-11.6-42.6-17.7-11.3-35.3-23-44.2-44-5.8-14-4.4-28.3-6.2-42.4-1-7.2 2.4-16 12.3-16.7 9.4-.6 20.9-3.5 25.6 8.4 3.4 8.6 2.1 17-6.2 24-15 12.8-13.9 19.7 3.7 29.1 13.8 7.4 28.5 13.3 40.5 23.9 23.8 21 26 56 4.5 79.2-6.8 7.3-7.8 15.3-6 24.6.9 4.3 2.7 10.2-3.1 12.3-5.3 2-6.5-4-9.2-7-6.3-6.8-7.1-15-6.7-24.9ZM804.3 405.5c1.2 3.4 4.6 5.2 3 8.6-20.6.3-34.9-24.4-26-44 5-11.3 13.4-20.6 15.8-33.3 3-16.5 0-25.2-15-32.3-27-12.9-39.8-33-35.3-63.4 1.4-9.4 1.4-17.6-11.8-20.7-9-2.2-11.2-12.2-9.2-21 2-8.5 8.8-13.9 17-12.6 7.6 1.3 17.4 3.5 16.7 15.4-.2 3-.4 6.1 2 8.4 11 11 8.6 24.1 6 37.1-2.2 11.1 0 20.3 9.8 26.8 6.4 4.2 12.5 8.9 19.2 12.6a49 49 0 0 1 13 78.4c-14.3 16-15.7 25.7-5.2 40ZM851 92c16.8-7 17.8-16.8 17.5-33.6 0-5-2.4-10 .8-14.9 11.1 2.4 17.6 16.4 14 30a48 48 0 0 1-48.7 35.4 41.9 41.9 0 0 0-31.2 13c-7.7 7-16.5 10.5-27 4.4 18.8-9.4 31.1-30.8 55.7-28.2 6.8.7 12-3.5 18.8-6Z" fill="#000"/></g><g transform="translate(266 207)"><path d="M255 299.7c11-28 26-52.4 44-75.1a51 51 0 0 1 9-8.7c3-2.5 7.3-5.4 4.2-10.6-5.5-9.3-1.9-17.1 4.6-24.5-3.5-6-7.2-11.7-10-17.7-5.9-12.2.1-24.3 13.4-27.3 17.5-4 34.5-3.6 50 7 2.8 2 6.1 2.9 10 4.6 3.3-9.8 6-19 9.7-28 6.2-15.3 20-18 30.9-6.1 2.5 2.8 4.7 4.1 8.3 4.5 15.6 1.6 15.5 1.7 19.9 16.6 16.1-4.2 32.3-9 48.6-12.6 37-7.9 74.2-13.2 112.3-8.2a397 397 0 0 1 93.7 22.6c55.7 21.9 105.4 52.6 144.9 98.3 32.3 37.4 64.6 74.9 96.2 113 8.7 10.4 15.4 23 7.8 37.6-5 9.7-14 14.5-23.4 18.3-41.9 17.4-82.8 10.5-124.1-3.7-27-9.3-51-24.8-77.7-34.3-3.9-1.4-7.5-4-12.2-3-4 7.9-.9 16.9-6.5 25.3-12.2 18.1-30.6 17.3-47.8 17.7-27.6.6-55.2-2.4-82.1-8.9-30.5-7.4-60.9-14.7-90.1-25-4 4.5-.4 7 1 9.7 7.6 15.5-.8 29.8-17.8 30.3-8.2.2-16-.3-23.3-4.9-4-2.5-8.5-4-13.6-2.7-3 7.3 1 14.2 1.4 21.2 1 25.9-5.3 50.5-11.7 75.2-6.4 24.3-20.2 44.8-32 66.3-2.9 5.2-6.5 11.1-13.4 10.1-7.6-1-5.2-8.6-6.5-13.6-4.3-16.3-2.2-34-9.6-49.7-7.3-15.4-15.8-30.2-31.5-39-12.6-7-29.5-3.4-36.2 9.2-2.8 5.2-8.3 5.5-11.3 10.7-5.6 9.8-13.7 17.8-12.2 30.5.3 2.4-2.7 4-6.5 3.6a230 230 0 0 1-23-123c1.7-17.8 1-35.7 2.3-53.6 1.3-17.7 6.2-34.2 10.3-52Z" fill="#000"/></g><g transform="translate(791 871)"><g fill-rule="evenodd" clip-rule="evenodd"><path d="M141.4 72.2c-23-2.7-47.2-5.5-66.3 14.6-4 3.5-6.5 8.5-6.8 13.8-18.2-4.6-32-31.2-23.7-46.7 6.6-12.4 19.8-14.6 32.5-16.3 29-4 56.6 5 78.7 20.1 13.2 9.1 23.7 8.7 36 8.2h2.6l.8-.1c7-.3 14-.6 18.3 7 4.6 8.4 4.2 16.7-1.5 24-6.1 7.8-12.6 16-25 18.1-4-22.2-16-39.5-38.4-41.9l-7.2-.8Zm-19.7 33.7c-1.5-1.7-3-3.4-4.7-5-3.5-4-7.1-7.7-9.9-12-3.9-6.3-8.2-5.4-12.8-2.7-7 4.2-14.3 9-12.9 18.6 1 6 5.4 5.6 9.5 5.3 1 0 2-.2 3-.1h17.2c18-.4 35.9-.7 53 7 2.1 1 4.5.4 6-1.3-1.3-18.7-28-35.8-46.5-29.6 0 2 .8 4.3 1.7 6.4 1.9 4.6 3.7 9.2-3.6 13.4Z" fill="#fff"/><path d="M29.1 56c2.9-21.8 32-32.2 54.7-32.5 31.5-.5 61 9.1 87.7 26.1 5 3.4 11 4.5 16.8 3 19.4-4.3 32.8.4 38.1 11.8 10.4 22-.5 43.8-11.6 53.2-20.5 17-43.8 16.5-67.3 9.4a81.2 81.2 0 0 0-34.7-3c-32.1 4-59.2-5.9-76.6-34a49.7 49.7 0 0 1-7-34Zm46 30.8c19.1-20 43.3-17.3 66.3-14.6l7.2.8c22.4 2.4 34.5 19.7 38.5 42 12.3-2.3 18.8-10.4 25-18.3 5.6-7.2 6-15.5 1.4-23.8-4.2-7.7-11.3-7.4-18.3-7.1h-.8l-2.5.1c-12.4.5-22.9 1-36-8.2A112.4 112.4 0 0 0 77 37.6c-12.7 1.7-25.9 3.9-32.5 16.3-8.2 15.5 5.5 42.1 23.7 46.7.3-5.3 2.7-10.3 6.8-13.8Zm46.6 19-4.7-5c-3.5-3.8-7.1-7.6-9.9-12-3.9-6.2-8.2-5.3-12.8-2.6-7 4.2-14.3 9-12.9 18.6 1 6 5.4 5.6 9.5 5.3 1 0 2-.2 3-.1h17.2c18-.4 35.9-.7 53 7 2.1 1 4.5.4 6-1.3-1.3-18.7-28-35.8-46.5-29.6 0 2 .8 4.3 1.7 6.4 1.9 4.6 3.7 9.2-3.6 13.4Z" fill="#000"/></g></g><g transform="translate(653 805)"></g><g transform="translate(901 668)"><path d="M41.2 197.6c-5.4-4.8-10.2-9.4-5.5-15.8 5-6.7 9.8.1 14.7 1.4 3.2.9 5.6 4.4 9.3 3.3 6.5-1.8 14-2.5 15-11.4.8-8.5-6-10.5-11.7-13.1-4.4-2-13 1-11.3-8 1.5-8.3 9.1-7.7 15.6-7.1a25 25 0 0 1 24 25c.5 16.2-8.4 28.5-23.3 30-8.7 1-18 2-26.8-4.3Z" fill="#000"/></g><g transform="translate(610 680)"><path d="M409.2 75.7c13.1.3 25.4 1 37.7 2.5 3 .3 4.9 3.3 5 6.6 0 3.4-1.8 5.7-4.8 7-11.1 4.9-22 8.3-33.7.2-6.5-4.4-8.9-8.6-4.2-16.3ZM254.7 78.4c6.2 3.3 5.2 7 2.1 10.8-6.5 8-28.2 10-36.4 3.5-4.7-3.8-7.3-8.6-4.4-14.4 3-6 8.2-5 13-2.5 8 4 16.4 3 25.7 2.6Z" fill="#000"/></g><g transform="translate(610 680)"></g><g transform="translate(774 657)"><path d="M30.3 32.1C58 10 89.8 13.1 121 14.1c5.7 0 12.2 1.3 14.3 8.3 2.1 7.7-4.6 9.9-8.8 13.8a44.7 44.7 0 0 1-52.2 8.6 37.9 37.9 0 0 0-31.9 1.6c-2 1-3.8 1.9-5.8 2.6-6.3 2.5-14.3 6-18.6-.4-4.4-6.7 5.6-9 8.3-13.7.6-1 2-1.6 3.9-2.8ZM294.4 23.8c7.7 4.3 14.5 10 20 17 2.5 3 5 6.3 3 10.2-2.4 4.3-6.7 2.7-10.4 2.2-12.5-1.5-23.7-9.2-37-7.2-5 .8-9.9.7-15 2.5-13 4.7-31-6.4-33-19.8-1-5.4 1-8.5 6.8-10 22.2-5.7 44-9 65.6 5.1Z" fill="#000"/></g><g transform="translate(0 559)"></g></g></svg> |