ServerKit

admin/ServerKit

0 Fork 0

mirror of https://github.com/jhd3197/ServerKit.git synced 2026-10-30 16:47:01 +09:00

Files

T

History

Juan DenisandClaude Opus 4.8 28cece380f feat(security): HTML-sink sweep guard (D4) — keep XSS sinks swept

Plan 55 Phase 1. The sweep found zero vulnerabilities: every raw-HTML sink is
safe by construction (escape-first SQL/file highlighters, sanitizeSvgInner for
extension icons, the escape-then-allowlist markdown renderer) and the backend
has no |safe/Markup(/render_template_string.

To keep it that way: scripts/check-html-sinks.mjs (wired into npm run lint) and a
Python mirror test (test_html_sink_sweep.py, runs in the backend suite) fail on
any raw-HTML sink that neither references an allowlisted sanitizer nor carries a
'sink-safe:' annotation. Standardized annotations on the three variable-fed sinks
(markdown, SQL editor, marketplace icon) and documented the rule in SECURITY.md.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-22 19:22:43 -04:00

deps

feat(install): Phase 3 — multi-distro abstraction, init/env detection, templated unit

2026-06-25 00:46:38 -04:00

dev

Add audit fallback, builtin extensions, and ports

2026-05-03 15:57:02 -04:00

lib

fix(cli): wrapper parity with backend/cli.py + bash tab-completion

2026-07-11 01:23:00 -04:00

test

Add test sandbox and harden install scripts