gitea-admin/gh-christianlouis-docuelevate
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: resolve ssrf verification issue and xss in frontend

Browse Source 
Resolves a Cross-Site Scripting (XSS) vulnerability in `frontend/templates/files.html` by applying `escapeHtml` and `sanitizeHighlight` functions when injecting search result attributes directly into the DOM via `innerHTML`.

Also fixes an issue in `app/api/url_upload.py` where providing the `event_hooks` argument twice caused a `SyntaxError` (and potentially bypassed security hooks). Both `validate_redirect` and `verify_redirect` hooks are now safely consolidated into a single list for the `httpx.AsyncClient` initialization.

Also updates tests and .gitignore to prevent CI issues.

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
This commit is contained in:
google-labs-jules[bot]
2026-05-17 14:32:51 +00:00
parent 58b14ae769
commit 46ab0ad8e2
5 changed files with 127 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitignore
+2
View File
@@ -200,3 +200,5 @@ cython_debug/
# Build metadata files - generated at build time
GIT_SHA
RUNTIME_INFO
node_modules
frontend/node_modules