[object Object]

← back to Re Flyer Aggregator

Add creds-in-URL fetch guard to flyers/index.html (TK-12282)

936f051d66db86abe90efb6ec60e321bb4b0c7c3 · 2026-09-25 14:12:30 -0700 · Steve

Closes the last local baseline hole in creds-guard-canary: this
Basic-Auth-gated page did a relative fetch() without the fleet
guard, so a saved user:pass@host bookmark would poison
document.baseURI and silently render an empty page. Same pattern
already applied fleet-wide (portal.html, TK-12268 commits).

Note: the LIVE Kamatera copy (/root/public-projects/re-flyer-
aggregator/public/flyers/index.html, pm2 re-flyers-viewer :9906)
already carries an equivalent guard applied directly to prod
outside git (drift) -- this commit brings the tracked source back
in sync with what's actually running; deploy queued for consistency,
not to fix a live vuln.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01D7LB6rCwpA7ubJTqYzqXEX

Files touched

Diff

commit 936f051d66db86abe90efb6ec60e321bb4b0c7c3
Author: Steve <steve@designerwallcoverings.com>
Date:   Fri Sep 25 14:12:30 2026 -0700

    Add creds-in-URL fetch guard to flyers/index.html (TK-12282)
    
    Closes the last local baseline hole in creds-guard-canary: this
    Basic-Auth-gated page did a relative fetch() without the fleet
    guard, so a saved user:pass@host bookmark would poison
    document.baseURI and silently render an empty page. Same pattern
    already applied fleet-wide (portal.html, TK-12268 commits).
    
    Note: the LIVE Kamatera copy (/root/public-projects/re-flyer-
    aggregator/public/flyers/index.html, pm2 re-flyers-viewer :9906)
    already carries an equivalent guard applied directly to prod
    outside git (drift) -- this commit brings the tracked source back
    in sync with what's actually running; deploy queued for consistency,
    not to fix a live vuln.
    
    Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
    Claude-Session: https://claude.ai/code/session_01D7LB6rCwpA7ubJTqYzqXEX
---
 public/flyers/index.html | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/public/flyers/index.html b/public/flyers/index.html
index 73ac0ec..0098212 100644
--- a/public/flyers/index.html
+++ b/public/flyers/index.html
@@ -1,4 +1,28 @@
 <!doctype html><html lang="en"><head><meta charset="utf-8">
+<script>
+// Credential-safe fetch guard (fleet drop-in) — if this page is opened with
+// credentials in the URL (a saved bookmark / Chrome-remembered basic-auth:
+// https://user:pass@host/…), the browser poisons document.baseURI, so any
+// relative or root-relative fetch('/api/…') throws "Request cannot be constructed
+// from a URL that includes credentials" and callers silently fall to an empty
+// state. Resolve every non-absolute request URL against the credential-free
+// location instead of baseURI. Placed first so it wraps window.fetch before any
+// app script runs. Ref: creds-in-url-fetch-guard-fleet-pattern.
+(function () {
+  var _fetch = window.fetch.bind(window);
+  var cleanBase = function () { return location.origin + location.pathname; };
+  window.fetch = function (input, init) {
+    try {
+      if (typeof input === 'string' && !/^[a-z]+:\/\//i.test(input) && input.indexOf('//') !== 0) {
+        input = new URL(input, cleanBase()).href;
+      } else if (input instanceof Request && !/^[a-z]+:\/\//i.test(input.url)) {
+        input = new Request(new URL(input.url, cleanBase()).href, input);
+      }
+    } catch (_) { /* fall through to native */ }
+    return _fetch(input, init);
+  };
+})();
+</script>
 <meta name="viewport" content="width=device-width,initial-scale=1">
 <title>Flyers — Abrams | CRE deal flyers</title>
 <style>

← 4444e01 auto-data-snapshot: 2026-09-25T12:54:38 (6 data files) — dat  ·  back to Re Flyer Aggregator  ·  auto-data-snapshot: 2026-09-25T16:33:34 (6 data files) — dat 63b1261 →