update dev branch

.gitattributes

@@ -9,18 +9,22 @@
 # mark samfile as shell
 samfile linguist-language=Shell
 
-go.work linguist-language=Shell
-go.mod linguist-language=Shell
+go.work linguist-language=go
+go.mod linguist-language=go
 
 # HTML DIR
 /cmd/findergen/frontend/** linguist-vendored
 
-/finder-template-generator-ssg/size-plugin.ts linguist-vendored
+/finder-template-generator-ssg/md-linter-plugin.ts linguist-vendored
+/finder-template-generator-ssg/vite-pluginbuild-stats.ts linguist-vendored
 /finder-template-generator-ssg/pages-ssg-plugin.ts linguist-vendored
+
+/finder-template-generator-ssg/src/pages.d.ts linguist-vendored
 /finder-template-generator-ssg/src/jsx-runtime.ts linguist-vendored
 /finder-template-generator-ssg/src/jsx.d.ts linguist-vendored
 
 /finder-template-generator-ssg/src/templates.js linguist-vendored
-/finder-template-generator-ssg/public/install.sh
+
+/finder-template-generator-ssg/public/install.sh linguist-vendored
 
 /.obsidian/** linguist-vendored

SECURITY.md

@@ -0,0 +1,21 @@
+# Security Policy
+
+## Supported Versions
+
+Use this section to tell people about which versions of your project are
+currently being supported with security updates.
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 5.1.x   | :white_check_mark: |
+| 5.0.x   | :x:                |
+| 4.0.x   | :white_check_mark: |
+| < 4.0   | :x:                |
+
+## Reporting a Vulnerability
+
+Use this section to tell people how to report a vulnerability.
+
+Tell them where to go, how often they can expect to get an update on a
+reported vulnerability, what to expect if the vulnerability is accepted or
+declined, etc.

finder-template-generator-ssg/src/configeditor/editor.tsx

@@ -117,6 +117,9 @@ export function setupConfigEditor(
 
   function setPath(obj: any, path: string, value: unknown) {
     const parts = path.split(".");
+    const blockedKeys = new Set(["__proto__", "constructor", "prototype"]);
+    if (parts.some((part) => blockedKeys.has(part))) return;
+
     let cur = obj;
     for (let i = 0; i < parts.length - 1; i++) {
       const p = parts[i];

finder-template-generator-ssg/src/configeditor/mount.ts

@@ -31,13 +31,26 @@ export function initConfigEditor(
 
   function setPath(obj: any, path: string, value: unknown) {
     const parts = path.split(".");
+    const isUnsafeKey = (key: string) =>
+      key === "__proto__" || key === "constructor" || key === "prototype";
+
     let cur = obj;
     for (let i = 0; i < parts.length - 1; i++) {
       const p = parts[i];
+      if (isUnsafeKey(p)) {
+        throw new Error(`initConfigEditor: Unsicherer Pfad-Segmentname "${p}".`);
+      }
       if (typeof cur[p] !== "object" || cur[p] === null) cur[p] = {};
       cur = cur[p];
     }
-    cur[parts[parts.length - 1]] = value;
+
+    const last = parts[parts.length - 1];
+    if (isUnsafeKey(last)) {
+      throw new Error(
+        `initConfigEditor: Unsicherer finaler Pfad-Segmentname "${last}".`,
+      );
+    }
+    cur[last] = value;
   }
 
   function readField(