Repository navigation

fix(ui): escape untrusted node, observer and route values in HTML rendering - #373

Merged

dborup merged 10 commits into

codex/issue-333-escape-untrusted-ui

Oct 13, 2026

Merged

fix(ui): escape untrusted node, observer and route values in HTML rendering#373
dborup merged 10 commits into
masterfrom
codex/issue-333-escape-untrusted-ui

Commits on Oct 8, 2026
- fix(ui): escape untrusted node, observer and route values in HTML rendering
  
  dborup
  and
  claude
  committed
  97b4a1f
Commits on Oct 12, 2026
- Merge origin/master into codex/issue-333-escape-untrusted-ui
  dborup
  committed
  d185235
- test(xss): run the escapers the sinks really call; match sinks in either shape (#333)
  
  dborup
  and
  claude
  committed
  7f6aa59
- test(ui): reproduce the adjacent #333 sinks found in review (F1-F3)
  
  dborup
  and
  claude
  committed
  592d841
- fix(packets): escape the region badge in group child rows and the flat view (#333)
  
  dborup
  and
  claude
  committed
  8401fa8
- fix(region-filter): escape observer region codes and labels (#333)
  
  dborup
  and
  claude
  committed
  d4bdbfd
- fix(observers): drop the inline onclick on observer rows (#333)
  
  dborup
  and
  claude
  committed
  4eb76dc
- test(xss-gate): reproduce the concat-into-attribute and URL-in-string misses (#333)
  
  dborup
  and
  claude
  committed
  ed9c45c
- fix(xss-gate): parse strings left to right; document the same-line limit (#333)
  
  dborup
  and
  claude
  committed
  a031513
- fix(ui): escape region summaries and drop the repeater inline onclick (#333)
  
  dborup
  and
  claude
  committed
  8474b49