fix/security-hardening #1

hzhang · 2026-05-16T16:29:41Z

hzhang commented

2026-05-16 16:29:41 +00:00

No description provided.

hzhang added 2 commits 2026-05-16 16:29:41 +00:00

Security hardening: prevent stored XSS and render crashes 045c7c51d6

- MarkdownView: add rehype-sanitize between rehype-raw and rehype-katex
  to strip scripts/event-handlers/javascript: URLs from user-authored
  markdown (was stored XSS, also affected the public /pg/* route);
  keep className on code/span/div so KaTeX and syntax highlighting
  still work. Add rehype-sanitize ^6.0.0 to deps and lockfile.
- MarkdownContent / StandaloneMarkdownPage: parse markdown content via
  parseMarkdownContent() instead of an unguarded JSON.parse, so a single
  corrupt/legacy record no longer white-screens the whole page.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

feat: dark-tech UI redesign + markdown patch cards 952387d50f

Redesign the frontend with a dark-tech theme: add Tailwind + PostCSS,
design tokens, and shadcn-style primitives (Button/Card/Input/Dialog/
DropdownMenu/Tabs/ScrollArea/etc.); restyle the app shell, navigation,
sidebar tree, content view, markdown rendering, editors, modals and
settings panels. Behavior/props unchanged; Font Awesome replaced with
lucide-react.

Add the patch cards feature UI: patch-queries hooks and a PatchCards
component rendered below the markdown body, with an Add Patch button
and create/edit dialog.

Fix tree expandability: folders with an index page now expand on name
click (and navigate), and the chevron+folder icon is one larger toggle.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

hzhang merged commit e91bea280b into master

2026-05-16 16:29:51 +00:00

hzhang deleted branch fix/security-hardening

2026-05-16 16:29:51 +00:00

hzhang referenced this issue from a commit

2026-05-16 16:29:53 +00:00

Merge pull request 'fix/security-hardening' (#1) from fix/security-hardening into master

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: hzhang/HangmanLab.Frontend#1