anchorcastapp Files

AnchorCast v1.4.0 — Security & Bug Fix Release

🔒 Security Hardening + 🐞 Bug Fixes

This release combines a full security audit of the v1.3.0 codebase with several bug fixes discovered during testing. No new features.

If you run AnchorCast with the Remote Control enabled or on a shared network, this update is strongly recommended.

🚨 Critical Fixes

• Settings API exposed credentials — GET /api/settings returned stored API keys (Claude, Deepgram, Genius) and all remote control PINs to any device on the same Wi-Fi with no authentication. Sensitive fields are now stripped for non-local callers
• Settings API open to writes — Any LAN device could overwrite all app settings (including changing PINs or API keys) via POST /api/settings with no authentication. Now protected
• External URL injection — The open-external IPC handler accepted any URL scheme, allowing a malicious payload to launch file://, ms-msdt://, or other system protocol handlers. Now restricted to https:, http:, and mailto: only

⚠️ High Severity Fixes

• Same-origin policy was disabled — Both the main window and projection window had webSecurity: false, disabling the browser's cross-origin protections. Removed from both windows; local media files continue to load via the media:// protocol
• Arbitrary file read via media:// — The custom media protocol had no path restriction and would serve any file on the filesystem. Now restricted to the AnchorCast data directory and app assets
• Remote PINs stored in plaintext — PINs were saved as plain text in settings.json and compared with simple string equality. Now hashed with PBKDF2 (SHA-256, 100k iterations, unique salt per PIN) and compared in constant time. Existing PINs migrate automatically on next save — no action needed
• Presentation import command injection — import-presentation passed a caller-supplied file path into a PowerShell command string with insufficient escaping. File path is now resolved, validated, and passed as a positional argument — never interpolated into a command string

🛡️ Medium Severity Fixes

• Projection control API unauthenticated — POST /api/control (which drives the live projection display) required no token or PIN. Any device on the local network could project arbitrary content mid-service. Now protected
• Whisper server reinforcement endpoint unauthenticated — Any local process could inject arbitrary text into the Whisper AI context window, biasing live transcription output. The Whisper server now requires a per-run shared secret on every request
• Whisper server memory exhaustion — The /transcribe endpoint had no payload size limit and no lock timeout. Now enforces a 10 MB cap and 30-second timeout
• XSS in live transcript display — Whisper interim transcript text was rendered directly into innerHTML. Fixed
• XSS in service replay timeline — Archived service payload data (verse refs, song titles, transcript text) rendered unescaped. Fixed
• XSS in HTML renderer pages — Six renderer HTML files had user-derived strings injected raw into innerHTML. All patched with escH() escaping
• Song lyric sanitizer bypassable — The projection HTML sanitizer missed unquoted event handlers, style=url(javascript:...), and backtick-quoted attributes. Hardened to cover all cases

📋 Other Security Fixes

• Remote session token moved from localStorage to sessionStorage — clears when the browser tab is closed
• NSIS installer scripts now use GetTempFileName — prevents TOCTOU race on predictable temp paths
• VC++ fallback download now verified with SHA-256 before execution
• Content-Security-Policy headers added to all Express HTTP responses
• "asar": true explicitly set in all electron-builder configs
• Electron upgraded from v31 (EOL) to v33

🐞 Bug Fixes

• macOS: Black screen on relaunch — Closing AnchorCast with Cmd+Q then reopening from the Dock showed a blank dark window. The renderer HTTP server was shut down on quit but macOS kept the process alive — when re-opened, the main window loaded against a dead server port and silently stayed black. The activate handler now restarts the renderer server automatically before creating windows
• macOS: Splash screen stuck on Dock relaunch — Clicking the Dock icon after closing showed the splash progress bar indefinitely. Stale window refs and state were not reset between close and reactivate. Full reset added with a 12-second fallback timeout so the splash never hangs forever
• macOS: "Could not check for updates" HTTP 404 — The update checker requested latest-mac-arm64-mac.yml (double -mac suffix) instead of latest-mac-arm64.yml. Corrected to match what electron-builder actually publishes
• Media import silently failing — Removing webSecurity: false (security fix) caused file.path to stop being populated on File objects from drag-and-drop. Files appeared to be accepted but nothing was imported. Fixed using webUtils.getPathForFile() — the correct Electron API — exposed via preload
• PowerPoint import failing on Windows — The PowerShell injection fix changed to param() + -Args, but -Args only works with -File, not -Command. $src was always empty, causing a COM error. Script is now written to a temp file and run with -File + positional arguments
• Remote control Copy URL / Share not working — navigator.clipboard requires HTTPS. The remote runs on http://192.168.x.x so clipboard writes silently failed. Fixed with a 3-method fallback that works on any HTTP origin
• Remote control showing "Error 429" — A stale session token caused repeated auth failures, triggering a rate limit. The raw HTTP code was shown with no guidance. All remote error responses now show friendly messages; 401 and 429 both show the PIN entry screen automatically
• Deepgram false "Invalid API key" toast — When Deepgram was selected as the transcript source, the main process still tried to process audio chunks and fired transcript-no-key when it had no handler for the deepgram source. Added guard to skip main-process chunk handling when Deepgram is active
• Sermon Notes limited to ~5 points — max_tokens: 2000 caused the JSON response to be silently truncated for longer sermons. Increased to 4096 with explicit prompt instruction to capture all points

📦 Downloads

Upgrading from v1.3.0? Your data, settings, Whisper models, songs, transcripts, and schedules are fully preserved. Remote control PINs will be re-hashed automatically on first settings save — you do not need to re-enter them.

Upgrading from v1.2.0 or earlier? See the v1.3.0 release notes for full migration details first.