From 8e1e8c1275fcd11efc24753da96e22091cd30f23 Mon Sep 17 00:00:00 2001
From: Siddh2024 <siddh.sharma.247@gmail.com>
Date: Sat, 11 Jul 2026 18:02:47 +0530
Subject: [PATCH 1/2] fix: add aria-labels to icon-only buttons for
 accessibility

Several icon-only buttons (toggle visibility, settings) lacked aria-label
attributes, making them inaccessible to screen readers.

Adds descriptive aria-label to:
- Toggle key visibility button in popup
- Settings button in popup header
- Toggle visibility buttons in options page

Fixes #865
---
 src/options.html | 12 ++++++++++--
 src/popup.html   |  8 ++++++--
 2 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/src/options.html b/src/options.html
index 99a27e1a..f4ec8899 100644
--- a/src/options.html
+++ b/src/options.html
@@ -161,7 +161,11 @@ <h2 class="section-title">
           <p class="form-hint">Required for AI summarization</p>
           <div class="input-row">
             <input type="password" id="openai-key" class="form-input" placeholder="sk-..." />
-            <button class="toggle-vis" data-target="openai-key">
+            <button
+              class="toggle-vis"
+              data-target="openai-key"
+              aria-label="Toggle API key visibility"
+            >
               <svg
                 xmlns="http://www.w3.org/2000/svg"
                 width="16"
@@ -188,7 +192,11 @@ <h2 class="section-title">
           <p class="form-hint">Required for Speech-to-Text transcription</p>
           <div class="input-row">
             <input type="password" id="elevenlabs-key" class="form-input" placeholder="sk_..." />
-            <button class="toggle-vis" data-target="elevenlabs-key">
+            <button
+              class="toggle-vis"
+              data-target="elevenlabs-key"
+              aria-label="Toggle API key visibility"
+            >
               <svg
                 xmlns="http://www.w3.org/2000/svg"
                 width="16"
diff --git a/src/popup.html b/src/popup.html
index 324ef427..3393a517 100644
--- a/src/popup.html
+++ b/src/popup.html
@@ -40,7 +40,9 @@ <h1 class="setup-title">Initialize Copilot</h1>
           <label class="setup-label">OpenAI API Key</label>
           <div class="input-group">
             <input type="password" id="api-key-input" class="setup-input" placeholder="sk-..." />
-            <button id="toggle-key" class="toggle-btn">👁</button>
+            <button id="toggle-key" class="toggle-btn" aria-label="Toggle API key visibility">
+              👁
+            </button>
           </div>
 
           <button id="save-keys" class="setup-btn">
@@ -81,7 +83,9 @@ <h1 class="setup-title">Initialize Copilot</h1>
             </div>
           </div>
         </div>
-        <button id="settings-btn" class="icon-btn" title="Settings">⚙️</button>
+        <button id="settings-btn" class="icon-btn" title="Settings" aria-label="Settings">
+          ⚙️
+        </button>
       </header>
 
       <!-- Content Sections -->

From daa3d0158910ce61802e439e1406b6e8f36b0a2c Mon Sep 17 00:00:00 2001
From: Siddh2024 <siddh.sharma.247@gmail.com>
Date: Sun, 19 Jul 2026 21:28:16 +0530
Subject: [PATCH 2/2] fix: validate sender origin and enforce size limit on
 OFFSCREEN_AUDIO_CHUNK messages

---
 src/background.ts | 13 +++++++++++++
 src/config.ts     |  3 +++
 2 files changed, 16 insertions(+)

diff --git a/src/background.ts b/src/background.ts
index 3698d7b5..976a43a2 100644
--- a/src/background.ts
+++ b/src/background.ts
@@ -29,6 +29,7 @@ import {
   ELEVENLABS_STT_MODEL,
   JOINER_MESSAGE_MAX_TOKENS,
   MAX_PENDING_AUDIO_CHUNKS,
+  MAX_CHUNK_SIZE_BYTES,
   MAX_PROMPT_LENGTH,
   MIN_MEETING_DURATION_FOR_WELCOME,
   SUMMARIZATION_MAX_TOKENS,
@@ -2027,6 +2028,13 @@ chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
           return;
         }
 
+        const senderUrl = sender.url ?? "";
+        if (senderUrl && !senderUrl.endsWith("offscreen.html")) {
+          console.warn("[LateMeet] chunk rejected — unauthorized sender:", senderUrl);
+          sendResponse({ success: false, error: "Unauthorized sender" });
+          return;
+        }
+
         if (typeof message.audioBase64 !== "string" || !message.audioBase64) {
           sendResponse({ success: false, error: "Missing audio chunk payload" });
           return;
@@ -2034,6 +2042,11 @@ chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
 
         const base64Len = message.audioBase64?.length ?? 0;
         const approxBytes = Math.round((base64Len * 3) / 4);
+        if (approxBytes > MAX_CHUNK_SIZE_BYTES) {
+          console.warn("[LateMeet] chunk rejected — exceeds max size:", approxBytes);
+          sendResponse({ success: false, error: "Chunk exceeds maximum allowed size" });
+          return;
+        }
         if (DEBUG) {
           console.log(
             `[LateMeet] chunk received — ~${approxBytes} bytes  mimeType=${message.mimeType}`,
diff --git a/src/config.ts b/src/config.ts
index 8848b596..4081a3e3 100644
--- a/src/config.ts
+++ b/src/config.ts
@@ -67,3 +67,6 @@ export const MAX_PENDING_CHUNKS = 20;
 
 /** Timeout in milliseconds for draining pending audio chunks before dropping them. */
 export const DRAIN_TIMEOUT_MS = 30000;
+
+/** Maximum size in bytes for a single audio chunk payload. Prevents memory exhaustion from oversized chunks. */
+export const MAX_CHUNK_SIZE_BYTES = 10 * 1024 * 1024;