From d03c4667df4d7dad38f54d121084285e6f4c69d1 Mon Sep 17 00:00:00 2001
From: anupamme <mediratta@gmail.com>
Date: Wed, 12 Aug 2026 16:30:37 +0000
Subject: [PATCH] fix: V-001 security vulnerability

Automated security fix generated by OrbisAI Security
---
 src/cssfontface/main.js | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/cssfontface/main.js b/src/cssfontface/main.js
index 1136152..c3c3f8d 100644
--- a/src/cssfontface/main.js
+++ b/src/cssfontface/main.js
@@ -115,7 +115,11 @@ async function doCssFontFaceJailbreak() {
 
       kernel_patches(kpatches_u8);
 
-      const bin_rsp = await fetch(sessionStorage.getItem("payload_path"));
+      const payload_path = sessionStorage.getItem("payload_path");
+      if (!payload_path || /^[a-z][a-z0-9+\-.]*:\/\//i.test(payload_path) || payload_path.startsWith("//")) {
+        throw new Error("Invalid payload_path: absolute URLs are not allowed");
+      }
+      const bin_rsp = await fetch(payload_path);
       const bin_buf = await bin_rsp.arrayBuffer();
       const bin_u8 = new Uint8Array(bin_buf);