1. Image upload size limit — _MAX_IMAGE_BYTES = 10 MB in both serve/server.py and edit/server.py

2. Image MIME type whitelist — _ALLOWED_IMAGE_TYPES blocks SVG XSS in both servers
  3. Filename collision safety — _unique_image_name() helper in both servers
  4. OAuth CSRF — state token generated in edit/server.py auth-url, stored in _oauth_states, validated and discarded in callback; strava_api.auth_url() accepts optional state param
  5. Error message leak — upload processing errors now return generic "Processing failed" instead of exception type/message
  6. Handle injection in subprocess — _trigger_rebuild now asserts handle matches _VALID_HANDLE before passing to subprocess

bincio/extract/strava_api.py

@@ -37,16 +37,18 @@ class StravaError(Exception):
 
 # ── OAuth helpers ──────────────────────────────────────────────────────────────
 
-def auth_url(client_id: str, redirect_uri: str) -> str:
+def auth_url(client_id: str, redirect_uri: str, state: str = "") -> str:
     """Return the Strava OAuth authorization URL."""
-    params = urllib.parse.urlencode({
+    params: dict[str, str] = {
         "client_id": client_id,
         "redirect_uri": redirect_uri,
         "response_type": "code",
         "scope": "activity:read_all",
         "approval_prompt": "auto",
-    })
-    return f"{_AUTH_URL}?{params}"
+    }
+    if state:
+        params["state"] = state
+    return f"{_AUTH_URL}?{urllib.parse.urlencode(params)}"
 
 
 def exchange_code(client_id: str, client_secret: str, code: str) -> dict: