From 2f207a274a871bee4461b3cbf211090c8839718f Mon Sep 17 00:00:00 2001
From: Henry Jameson <me@hjkos.com>
Date: Wed, 5 Aug 2026 19:27:50 +0300
Subject: [PATCH 1/3] fix security issue sonarqube detected

---
 src/sw.js | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/sw.js b/src/sw.js
index b7629b5f2..908e86567 100644
--- a/src/sw.js
+++ b/src/sw.js
@@ -198,6 +198,10 @@ self.addEventListener('push', async (event) => {
 self.addEventListener('message', async (event) => {
   await setSettings()
   const { type, content } = event.data
+  if (self.location.origin !== event.origin) {
+    console.error('SW Message with strange origin received', event)
+    return
+  }
 
   if (type === 'desktopNotification') {
     const { title, ...rest } = content

From 621966d812f5313f73f8f053d310ce6b2def914a Mon Sep 17 00:00:00 2001
From: Henry Jameson <me@hjkos.com>
Date: Wed, 5 Aug 2026 19:35:58 +0300
Subject: [PATCH 2/3] another security issue found by sonarqube (might need to
 extend later)

---
 build/commit_hash.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/build/commit_hash.js b/build/commit_hash.js
index 8225817ee..3719f5906 100644
--- a/build/commit_hash.js
+++ b/build/commit_hash.js
@@ -7,7 +7,7 @@ export const getCommitHash = () => {
   } else {
     try {
       return childProcess
-        .execSync('git rev-parse --short HEAD')
+        .execSync('PATH=/usr/bin:/bin:/usr/local/bin:/sbin:/usr/sbin git rev-parse --short HEAD')
         .toString()
         .trim()
     } catch (e) {

From 2d52ce8017bd1b6cc3380e02b3b7a48f83b6f216 Mon Sep 17 00:00:00 2001
From: Henry Jameson <me@hjkos.com>
Date: Wed, 5 Aug 2026 19:40:46 +0300
Subject: [PATCH 3/3] lint

---
 build/commit_hash.js | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/build/commit_hash.js b/build/commit_hash.js
index 3719f5906..2b13afb93 100644
--- a/build/commit_hash.js
+++ b/build/commit_hash.js
@@ -7,7 +7,9 @@ export const getCommitHash = () => {
   } else {
     try {
       return childProcess
-        .execSync('PATH=/usr/bin:/bin:/usr/local/bin:/sbin:/usr/sbin git rev-parse --short HEAD')
+        .execSync(
+          'PATH=/usr/bin:/bin:/usr/local/bin:/sbin:/usr/sbin git rev-parse --short HEAD',
+        )
         .toString()
         .trim()
     } catch (e) {