pad/internal at 4297689e23b4211268720dc249439fc4d1c12d47 - pad

mirror of https://github.com/PerpetualSoftware/pad.git synced 2026-10-03 20:20:29 +00:00

Files

T

xarmian 4297689e23 fix(server): add script-src-attr 'none' to CSP (TASK-648) (#171 )

Inline event handlers (onerror, onload, onclick, …) bypass the
script-src directive per CSP spec. Without script-src-attr 'none' an
attacker who slips markup past the DOMPurify sanitizer can still
execute JavaScript via event attributes — defeating the whole point of
the nonce-based script-src.

Add 'script-src-attr 'none'' to both CSP headers:
- internal/server/middleware_security.go — strict policy for API responses
- internal/server/server.go — nonce-based policy for HTML pages

Defense-in-depth for TASK-647 (comment markdown sanitizer) and for any
future regression in HTML-emitting paths.

Parent: PLAN-643 (OSS Security Hardening).

2026-04-21 18:37:18 -04:00

cli

feat: add CLI commands for item starring (#120 )

2026-04-14 20:51:03 -04:00

collections

feat(cli): categorized template picker + interactive select (TASK-616) (#148 )

2026-04-18 06:31:24 -04:00

config

feat: add cloud infrastructure for hosted Pad (PLAN-427)

2026-04-12 17:43:40 +00:00

diff

Initial release