fix: all five omnibox_js scripts create an axios htt... in Film-优质资源.js

[anupamme]

Summary

Fix high severity security issue in omnibox_js/Film-优质资源.js.

Vulnerability

Field	Value
ID	V-001
Severity	HIGH
Scanner	multi_agent_ai
Rule	V-001
File	omnibox_js/Film-优质资源.js:13
Assessment	Likely exploitable

Description: All five omnibox_js scripts create an axios HTTP client instance with rejectUnauthorized: false, which completely disables TLS certificate validation. This means the application will accept any certificate presented by the server, including self-signed, expired, or certificates issued by untrusted CAs.

Evidence

Exploitation scenario: An attacker who can position themselves on the network path between the client and the API servers (e.g., on the same WiFi network, via ARP spoofing, or at an ISP level) can intercept all HTTPS.

Scanner confirmation: multi_agent_ai rule V-001 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Changes

• omnibox_js/Film-优质资源.js

Behavior Preservation

The change is scoped to 1 file on the vulnerable path, and the project's existing tests still pass, so intended behavior is unchanged.

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security