mirror of
https://github.com/garrytan/gstack.git
synced 2026-07-18 13:37:23 +02:00
279fda4dc5
urlBlocklistFilter compared URLs against the exfiltration blocklist with case-sensitive substring checks, so an uppercased sink (https://WEBHOOK.SITE/x) bypassed the guard and reached the scoped browser agent. Normalize the page URL and extracted content URLs to lowercase before comparing, and make URL extraction scheme-insensitive so HTTPS:// links are still caught. Fixes #2190 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>