H1 — stored XSS via v-html / innerHTML of unsanitized LLM/agent/interview/report
content: add DOMPurify; both renderMarkdown() now return DOMPurify.sanitize(html)
(Step4Report.vue, Step5Interaction.vue), and the formatAnswer innerHTML sink is
wrapped in DOMPurify.sanitize. All 8 HTML-injection sinks now sanitized; markdown
rendering preserved (DOMPurify secure defaults keep the md-* tags/classes).
H4 — wildcard CORS: CORS origins now Config.ALLOWED_ORIGINS (comma-separated env,
default localhost:3000) instead of '*'.
H5 — request bodies written to disk in cleartext: logger file level now follows
FLASK_DEBUG (INFO in prod), so the before_request body-debug log is suppressed in
production. (traceback-in-response across 53 handlers deferred to a separate refactor.)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Created package-lock.json for dependency management.
- Updated package.json and frontend package.json to version 0.1.0.
- Adjusted backend pyproject.toml to reflect version 0.1.0.
- Introduced uv.lock for Python dependency resolution.
- Added D3.js as a dependency in `package.json` and `package-lock.json` for data visualization capabilities.
- Introduced a new `pendingUpload.js` store to manage files and simulation requirements before initiating the simulation process.
- Updated `Home.vue` to store pending uploads and navigate to the `Process` page immediately, deferring API calls for improved user experience.
- Enhanced `Process.vue` to handle new project initialization and display project status effectively, including progress tracking for ontology generation and graph building.
- Introduced `PROJECT_STATUS.md` to provide a comprehensive overview of the MiroFish project, detailing the current status, completed features, and future development plans.
- Added multiple documentation files in the frontend directory, including detailed descriptions of the homepage functionality, startup guide, and project completion summary.
- Implemented a structured approach to document the project's architecture, API integration, and user interaction processes, enhancing clarity for developers and users alike.
- Included a `.gitignore` file to manage ignored files and directories in the frontend project, improving project organization and cleanliness.
Yo-LRK
ghostubborn
BaiFu