fix: the simtextpreview component constructs fetch u... in...

[anupamme]

Summary

Fix high severity security issue in src/components/preview/SimTextPreview.vue.

Vulnerability

Field	Value
ID	V-001
Severity	HIGH
Scanner	multi_agent_ai
Rule	V-001
File	src/components/preview/SimTextPreview.vue:555
Assessment	Likely exploitable

Description: The SimTextPreview component constructs fetch URLs with sensitive query parameters including fileId, userId, username, and file paths. These parameters are transmitted in the URL query string without encryption, making them visible in browser history, server logs, and vulnerable to interception.

Evidence

Exploitation scenario: An attacker positioned on the network (Man-in-the-Middle) can intercept the fetch request and extract sensitive identifiers from the query string.

Scanner confirmation: multi_agent_ai rule V-001 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Threat Model Context

This is a Node.js library - vulnerabilities affect downstream consumers who use this package.

Changes

• src/components/preview/SimTextPreview.vue

Behavior Preservation

The change is scoped to 1 file on the vulnerable path; it only tightens handling of untrusted input and leaves valid inputs unaffected.

---

Automated security fix by OrbisAI Security

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.