xarmian 42cc220024 fix(web): sanitize rendered markdown through DOMPurify (TASK-647) (#170) ...

* fix(web): sanitize rendered markdown through DOMPurify (TASK-647)

Comments (and any other caller of renderMarkdown) piped marked() output
straight to {@html}. A malicious comment could inject <script> / <img
onerror> / javascript: links that executed on every viewer's page —
stored XSS with full session takeover.

Wrap renderMarkdown's output in DOMPurify.sanitize with a strict
allowlist of markdown-produced tags and attributes. Also HTML-escape
the wiki-link title before interpolating it into the <a>/<span> so the
intermediate HTML is well-formed even for pathological titles.

Sanitization runs client-side only (adapter-static SPA mode has no
runtime SSR of user content). In SSR/prerender contexts we return ""
rather than emit unsanitized HTML — markdown-bearing views fetch their
data at runtime anyway, so the empty fallback is a no-op.

Parent: PLAN-643 (OSS Security Hardening).

* fix(web): allow ol start attribute in markdown sanitizer per Codex review

2026-04-21 18:33:11 -04:00

..

lib

fix(web): sanitize rendered markdown through DOMPurify (TASK-647) (#170)

2026-04-21 18:33:11 -04:00

routes

feat(web): view-mode selector renders as BottomSheet on mobile (TASK-636) (#166)

2026-04-20 15:06:53 -04:00

app.css

fix(web): drop repeating print-header, clean page-1 layout, skip empty rows (BUG-626) (#157)

2026-04-18 19:04:32 -04:00

app.d.ts

Initial release

2026-03-26 01:52:36 +00:00

app.html

feat: Redesign web UI with dashboard, activity feed, notifications, and mobile improvements

2026-03-28 13:55:23 +00:00