c0m4r/kula 0.9.1

on GitHub

[0.9.1] - 2026-03-15

Security

• Add Origin/Referer validation for state-changing HTTP requests to provide additional CSRF protection
• SRI hashes and CSP nonce injection for javascript files
• Security headers hardening
• WebSocket message size guard in the frontend
• Fix WebSocket double-unregistration bug using sync.Once
• Implement WebSocket connection limits (global and per-IP) to prevent resource exhaustion
• Harden WebSocket connection counting logic with defensive decrement patterns
• Harden X-Forwarded-For trust by using the rightmost IP in the chain
• Add upper bound to history API points parameter to prevent resource exhaustion