Yo-LRK 394638d426 security: address HIGH findings (stored XSS, wildcard CORS, prod log leak) ... H1 — stored XSS via v-html / innerHTML of unsanitized LLM/agent/interview/report content: add DOMPurify; both renderMarkdown() now return DOMPurify.sanitize(html) (Step4Report.vue, Step5Interaction.vue), and the formatAnswer innerHTML sink is wrapped in DOMPurify.sanitize. All 8 HTML-injection sinks now sanitized; markdown rendering preserved (DOMPurify secure defaults keep the md-* tags/classes). H4 — wildcard CORS: CORS origins now Config.ALLOWED_ORIGINS (comma-separated env, default localhost:3000) instead of '*'. H5 — request bodies written to disk in cleartext: logger file level now follows FLASK_DEBUG (INFO in prod), so the before_request body-debug log is suppressed in production. (traceback-in-response across 53 handlers deferred to a separate refactor.) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>		2026-06-13 17:32:36 +07:00
..
__init__.py	fix(i18n): pass locale to background threads via thread-local storage	2026-04-01 16:55:51 +08:00
file_parser.py	refactor: add type hints and FileParser.is_supported() helper	2026-05-23 14:57:46 +08:00
llm_client.py	fix: resolve 500 error caused by <think> tags and markdown code fences in content field from reasoning models like MiniMax/GLM	2026-03-06 00:30:31 +08:00
locale.py	fix(i18n): validate Accept-Language header against registered locales	2026-04-02 14:20:15 +08:00
logger.py	security: address HIGH findings (stored XSS, wildcard CORS, prod log leak)	2026-06-13 17:32:36 +07:00
retry.py	Enhance backend functionality with OASIS simulation features	2025-12-01 15:03:44 +08:00
zep_paging.py	feat(graph): implement pagination for fetching nodes and edges; add utility functions for streamlined data retrieval	2026-02-27 15:53:29 +08:00