Skip to content

fix: harden generated pages and dev server paths#288

Merged
brendanjryan merged 1 commit into
mainfrom
brendanjryan/fix-code-scanning-alerts
Jun 25, 2026
Merged

fix: harden generated pages and dev server paths#288
brendanjryan merged 1 commit into
mainfrom
brendanjryan/fix-code-scanning-alerts

Conversation

@brendanjryan

Copy link
Copy Markdown
Collaborator

Summary

  • Enable Jinja HTML autoescaping for generated site pages
  • Normalize and constrain local dev-server request paths before filesystem resolution
  • Add tests for traversal rejection and expected path handling

Motivation

Address code-scanning concerns around generated HTML rendering and local static-file path resolution.

Key design considerations

  • Keep generated page output unchanged for existing trusted content
  • Preserve clean problem-page URL handling
  • Restrict the dev server to localhost and reject decoded parent-directory traversal

@brendanjryan brendanjryan marked this pull request as ready for review June 25, 2026 18:12
@github-actions

Copy link
Copy Markdown

Spec Preview

Spec Changed Artifacts
draft-card-charge-00 - HTML · TXT · XML · PDF
draft-evm-charge-00 - HTML · TXT · XML · PDF
draft-hedera-charge-00 - HTML · TXT · XML · PDF
draft-httpauth-payment-00 - HTML · TXT · XML · PDF
draft-lightning-charge-00 - HTML · TXT · XML · PDF
draft-lightning-session-00 - HTML · TXT · XML · PDF
draft-nearintents-charge-00 - HTML · TXT · XML · PDF
draft-payment-discovery-00 - HTML · TXT · XML · PDF
draft-payment-intent-charge-00 - HTML · TXT · XML · PDF
draft-payment-transport-mcp-00 - HTML · TXT · XML · PDF
draft-solana-charge-00 - HTML · TXT · XML · PDF
draft-stellar-charge-00 - HTML · TXT · XML · PDF
draft-stripe-charge-00 - HTML · TXT · XML · PDF
draft-tempo-charge-00 - HTML · TXT · XML · PDF
draft-tempo-session-00 - HTML · TXT · XML · PDF
draft-usdc-charge-00 - HTML · TXT · XML · PDF

Browse preview release assets

@brendanjryan brendanjryan requested a review from parvahuja June 25, 2026 18:14
@brendanjryan brendanjryan merged commit f667841 into main Jun 25, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants