Source: task/resolver-security-hardening (plan/steward-linker-security) — defense-in-depth: client trusted resolver href, outbound fetches had no timeout, CORS was blanket-*.
- F1: extension/content.js makeLink re-validates primary.url scheme via a new
pure Extract.isSafeHttpUrl helper (in extract.js, unit-tested); a non-http(s)
url (javascript:/data:/garbage) is dropped and the plain text is kept.
- F2: each of the three resolver outbound fetches (Spotify token, Spotify
search, ollama /api/chat) now carries signal: AbortSignal.timeout(5000) so a
hung upstream fails fast (caught per-candidate -> null), zero-dep.
- F3: resolver CORS reflects the request Origin only for moz-extension://* or
null (the extension's background-script origin), with Vary: Origin, instead
of blanket access-control-allow-origin: *.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
