Resolves a Cross-Site Scripting (XSS) vulnerability in `frontend/templates/files.html` by applying `escapeHtml` and `sanitizeHighlight` functions when injecting search result attributes directly into the DOM via `innerHTML`.
Also fixes an issue in `app/api/url_upload.py` where providing the `event_hooks` argument twice caused a `SyntaxError` (and potentially bypassed security hooks). Both `validate_redirect` and `verify_redirect` hooks are now safely consolidated into a single list for the `httpx.AsyncClient` initialization.
Also updates tests and .gitignore to prevent CI issues.
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
google-labs-jules[bot]
46ab0ad8e2