Yo-LRK 394638d426 security: address HIGH findings (stored XSS, wildcard CORS, prod log leak) ... H1 — stored XSS via v-html / innerHTML of unsanitized LLM/agent/interview/report content: add DOMPurify; both renderMarkdown() now return DOMPurify.sanitize(html) (Step4Report.vue, Step5Interaction.vue), and the formatAnswer innerHTML sink is wrapped in DOMPurify.sanitize. All 8 HTML-injection sinks now sanitized; markdown rendering preserved (DOMPurify secure defaults keep the md-* tags/classes). H4 — wildcard CORS: CORS origins now Config.ALLOWED_ORIGINS (comma-separated env, default localhost:3000) instead of '*'. H5 — request bodies written to disk in cleartext: logger file level now follows FLASK_DEBUG (INFO in prod), so the before_request body-debug log is suppressed in production. (traceback-in-response across 53 handlers deferred to a separate refactor.) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>		2026-06-13 17:32:36 +07:00
..
api	fix(i18n): replace hardcoded Chinese stage names in simulation prepare SSE	2026-04-01 17:31:00 +08:00
models	feat(i18n): replace hardcoded Chinese in backend SSE progress messages	2026-04-01 16:32:10 +08:00
services	security: harden C1-C4 (debug-RCE, auth, denial-of-wallet, sim deadline)	2026-06-13 17:19:05 +07:00
utils	security: address HIGH findings (stored XSS, wildcard CORS, prod log leak)	2026-06-13 17:32:36 +07:00
__init__.py	security: address HIGH findings (stored XSS, wildcard CORS, prod log leak)	2026-06-13 17:32:36 +07:00
config.py	security: address HIGH findings (stored XSS, wildcard CORS, prod log leak)	2026-06-13 17:32:36 +07:00