Yo-LRK 394638d426 security: address HIGH findings (stored XSS, wildcard CORS, prod log leak) ... H1 — stored XSS via v-html / innerHTML of unsanitized LLM/agent/interview/report content: add DOMPurify; both renderMarkdown() now return DOMPurify.sanitize(html) (Step4Report.vue, Step5Interaction.vue), and the formatAnswer innerHTML sink is wrapped in DOMPurify.sanitize. All 8 HTML-injection sinks now sanitized; markdown rendering preserved (DOMPurify secure defaults keep the md-* tags/classes). H4 — wildcard CORS: CORS origins now Config.ALLOWED_ORIGINS (comma-separated env, default localhost:3000) instead of '*'. H5 — request bodies written to disk in cleartext: logger file level now follows FLASK_DEBUG (INFO in prod), so the before_request body-debug log is suppressed in production. (traceback-in-response across 53 handlers deferred to a separate refactor.) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>		2026-06-13 17:32:36 +07:00
..
api	security: harden C1-C4 (debug-RCE, auth, denial-of-wallet, sim deadline)	2026-06-13 17:19:05 +07:00
assets/logo	Enhance homepage layout and styling	2025-12-10 15:15:44 +08:00
components	security: address HIGH findings (stored XSS, wildcard CORS, prod log leak)	2026-06-13 17:32:36 +07:00
i18n	feat(i18n): set up vue-i18n with dynamic locale loading	2026-04-01 15:22:14 +08:00
router	Implement interaction features in Step5Interaction component and add routing for interaction view	2025-12-16 17:50:43 +08:00
store	Add D3.js dependency and implement pending upload state management	2025-12-10 18:17:26 +08:00
views	fix(i18n): fix English workflow desc font size with correct CSS selectors	2026-04-01 19:11:22 +08:00
App.vue	Update font styles across the application to include 'Noto Sans SC' for improved typography consistency.	2025-12-26 17:35:09 +08:00
main.js	feat(i18n): set up vue-i18n with dynamic locale loading	2026-04-01 15:22:14 +08:00