Chuck 4d2a567597 fix(security): escape user input in raw HTML responses in pages_v3.py ...

plugin_id comes directly from the URL path
(/partials/plugin-config/<plugin_id>) and was interpolated into an HTML
fragment without escaping. A crafted URL like
/partials/plugin-config/<script>alert(1)</script> would inject that
tag into the DOM via the HTMX partial response.

Fix: wrap all user-controlled values in markupsafe.escape() before
embedding in raw HTML strings. Affects the plugin-not-found 404
response and both error 500 responses in the plugin config partial.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-05-14 12:57:58 -04:00

..

__init__.py

Plugins (#145)

2025-12-27 14:15:49 -05:00

api_v3.py

fix: remove unused imports and bare exception aliases (pyflakes F401/F841)

2026-05-14 10:41:55 -04:00

pages_v3.py

fix(security): escape user input in raw HTML responses in pages_v3.py

2026-05-14 12:57:58 -04:00