Replace codetabs with first-party proxy

[SirajChokshi]

Summary

• switch SvelteKit adapter from auto to Vercel
• add /api/proxy server route to fetch allowlisted GitHub/GitLab raw content
• replace client fetches from api.codetabs.com to internal proxy endpoint
• add proxy policy tests covering target validation and CORS/origin rules
• add .vercel/ to .gitignore
• fix SSR runtime safety in logger and ignore .vercel/** in ESLint
• tighten GitLab raw path validation to reject branch-only /-/raw/<branch> URLs without a file segment (off-by-one fix)

Security hardening

• only allows HTTPS targets on raw.githubusercontent.com and GitLab /-/raw/ paths
• rejects query strings and path traversal segments
• enforces request-origin allowlist (PROXY_ALLOWED_ORIGINS, with sensible defaults)
• caps upstream payload size to 5 MiB

Verification evidence

• automated checks: focused proxy tests + lint + svelte-check
• endpoint behavior checks:
  • /opt/cursor/artifacts/proxy_endpoint_checks.log
  • /opt/cursor/artifacts/gitlab_raw_branch_validation.log
• GUI walkthrough demo showing loaded preview and network calls via /api/proxy:
  • 
  • 
  • 

Notes

• README + AGENTS updated with proxy configuration guidance.

  

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
static-preview	Ready	Preview, Comment	Apr 6, 2026 10:56pm

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

Autofix Details

Bugbot Autofix prepared fixes for both issues found in the latest run.

• ✅ Fixed: GitLab path validation off-by-one allows branch-only URLs
  • Changed the length check from rawPathSegment + 2 to rawPathSegment + 3 to correctly require a file segment after the branch in GitLab raw paths.
• ✅ Fixed: Proxy follows redirects without validating redirect destination
  • Replaced redirect: 'follow' with redirect: 'manual' and added a loop that validates each redirect target against isAllowedProxyTarget before following it, preventing SSRF via open redirects.

Or push these changes by commenting:

@cursor push 26bb8719f4

Preview (26bb8719f4)

diff --git a/src/routes/api/proxy/+server.ts b/src/routes/api/proxy/+server.ts
--- a/src/routes/api/proxy/+server.ts
+++ b/src/routes/api/proxy/+server.ts
@@ -4,6 +4,7 @@
   getAllowedProxyOrigins,
   getRequestOrigin,
   isAllowedOrigin,
+  isAllowedProxyTarget,
   MAX_PROXY_RESPONSE_BYTES,
   parseProxyTarget,
   ProxyRequestError,
@@ -50,15 +51,41 @@
   }
 
   let upstream: Response
+  let currentTarget = target
 
   try {
-    upstream = await fetch(target.toString(), {
-      redirect: 'follow',
-      headers: {
-        Accept: request.headers.get('accept') ?? '*/*',
-      },
-    })
-  } catch {
+    const maxRedirects = 5
+    for (let i = 0; ; i++) {
+      upstream = await fetch(currentTarget.toString(), {
+        redirect: 'manual',
+        headers: {
+          Accept: request.headers.get('accept') ?? '*/*',
+        },
+      })
+
+      if (upstream.status < 300 || upstream.status >= 400) break
+      if (i >= maxRedirects) throw error(502, 'Too many redirects')
+
+      const location = upstream.headers.get('location')
+      if (!location) break
+
+      let redirectTarget: URL
+      try {
+        redirectTarget = new URL(location, currentTarget)
+      } catch {
+        throw error(502, 'Invalid redirect location')
+      }
+
+      redirectTarget.hash = ''
+
+      if (!isAllowedProxyTarget(redirectTarget)) {
+        throw error(403, 'Redirect target is not allowed')
+      }
+
+      currentTarget = redirectTarget
+    }
+  } catch (err) {
+    if (err && typeof err === 'object' && 'status' in err) throw err
     throw error(502, `Could not load ${target.toString()}`)
   }
 

diff --git a/src/utils/proxy.ts b/src/utils/proxy.ts
--- a/src/utils/proxy.ts
+++ b/src/utils/proxy.ts
@@ -70,7 +70,7 @@
 
   // /:owner/(optional subgroups...)/:repo/-/raw/:branch/:file...
   if (rawPathSegment < 2) return false
-  if (pathSegments.length <= rawPathSegment + 2) return false
+  if (pathSegments.length <= rawPathSegment + 3) return false
 
   return true
 }

_{You can send follow-ups to the cloud agent here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Autofix Details

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Invalid configured origins silently fall back to permissive defaults
  • Changed getAllowedProxyOrigins to return only valid parsed origins (possibly empty) whenever configuredOrigins is defined, reserving the permissive default fallback for when the env var is truly undefined.

Or push these changes by commenting:

@cursor push 22d9a116f6

Preview (22d9a116f6)

diff --git a/src/utils/proxy.ts b/src/utils/proxy.ts
--- a/src/utils/proxy.ts
+++ b/src/utils/proxy.ts
@@ -120,14 +120,14 @@
   configuredOrigins: string | undefined,
   requestOrigin: string,
 ): string[] {
-  const allowedOrigins = configuredOrigins
-    ?.split(',')
-    .map((origin) => origin.trim())
-    .filter(Boolean)
-    .map((origin) => normalizeOrigin(origin))
-    .filter((origin): origin is string => Boolean(origin))
+  if (configuredOrigins !== undefined) {
+    const allowedOrigins = configuredOrigins
+      .split(',')
+      .map((origin) => origin.trim())
+      .filter(Boolean)
+      .map((origin) => normalizeOrigin(origin))
+      .filter((origin): origin is string => Boolean(origin))
 
-  if (allowedOrigins && allowedOrigins.length > 0) {
     return [...new Set(allowedOrigins)]
   }

_{You can send follow-ups to the cloud agent here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Proxy serves arbitrary HTML at app origin enabling XSS
  • Added Content-Security-Policy: sandbox and Content-Disposition: attachment headers to proxy responses, preventing browsers from executing scripts or rendering HTML at the app's origin.

Or push these changes by commenting:

@cursor push 42265fb190

Preview (42265fb190)

diff --git a/src/routes/api/proxy/+server.ts b/src/routes/api/proxy/+server.ts
--- a/src/routes/api/proxy/+server.ts
+++ b/src/routes/api/proxy/+server.ts
@@ -81,6 +81,8 @@
     upstream.headers.get('content-type') ?? 'text/plain; charset=utf-8',
   )
   headers.set('X-Content-Type-Options', 'nosniff')
+  headers.set('Content-Security-Policy', 'sandbox')
+  headers.set('Content-Disposition', 'attachment')
   headers.set(
     'Cache-Control',
     upstream.headers.get('cache-control') ?? 'public, max-age=300',

_{You can send follow-ups to the cloud agent here.}

^{Reviewed by Cursor Bugbot for commit aa0bc52. Configure here.}