MechaCat02 958d5bd713 fix: scheme-validate crawler source_url before rendering as a link ...

Harvested source_url (external content) rendered as an admin <a href> without
scheme validation — a javascript:/data: link would execute on click (audit M2).
safeExternalHref() gates to http(s); CrawlerHistoryTable/DeadJobsTable fall back
to plain text otherwise. Tested in safeHref.test.ts.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-13 21:16:08 +02:00

..

migrations

perf: precompute mangas.sort_author for the author sort

2026-07-11 14:29:26 +02:00

src

refactor: remove unused constant_time_eq and correct the token doc

2026-07-13 20:22:39 +02:00

tests

test: cover the trusted_proxy X-Forwarded-For rate-limit gate

2026-07-13 21:13:37 +02:00

.dockerignore

bugfix: third-pass audit follow-ups (F1-F4 + dockerignore)

2026-05-17 00:13:14 +02:00

.gitignore

feat(analysis): add ocrs OCR backend and OCR-driven page text search

2026-06-30 19:52:43 +02:00

Cargo.lock

fix: scheme-validate crawler source_url before rendering as a link

2026-07-13 21:16:08 +02:00

Cargo.toml

fix: scheme-validate crawler source_url before rendering as a link

2026-07-13 21:16:08 +02:00

Dockerfile

feat(analysis): add ocrs OCR backend and OCR-driven page text search

2026-06-30 19:52:43 +02:00