Oliver Kieselbach c4be6d4169 fix(security): block javascript:/data: URLs in analyze-rule relatedDocs (stored XSS) ...

Author-controlled relatedDocs[].url was rendered verbatim as <a href> on the session
detail, diagnosis and analyze-rules pages and never validated server-side, so a
Tenant Admin could store a javascript: URL that executes in the portal origin for
any viewer — including cross-tenant Global/MSP admins.

- Web: safeHttpUrl() guard (absolute http/https only) at all four render sites;
  anything else renders as plain text.
- Backend: ValidateRelatedDocs on Create/Update — blank URLs dropped, non-http(s)
  URLs rejected with 400.
- Tests on both sides.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-08-29 17:55:50 +02:00

..

AutopilotMonitor.Functions

fix(security): block javascript:/data: URLs in analyze-rule relatedDocs (stored XSS)

2026-08-29 17:55:50 +02:00

AutopilotMonitor.Functions.Tests

fix(security): block javascript:/data: URLs in analyze-rule relatedDocs (stored XSS)

2026-08-29 17:55:50 +02:00

LICENSE

update license

2026-03-26 07:02:33 +01:00