Vinta Chen 704332271b fix(website): escape </script> in embedded filter URLs JSON ...

`| safe` bypasses Jinja autoescape. If a category name ever contained
"</script>", the literal substring would close the script block early,
leaking JSON content into the DOM and creating an XSS vector. Replace
"</" with "<\\/" (still valid JSON) and pass ensure_ascii=False so
non-ASCII names render readably. Also add a group_path() helper to
parallel category_path()/subcategory_path() and reuse category_urls
when seeding filter_urls.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-03 00:40:52 +08:00

..

test_build.py

fix(website): escape </script> in embedded filter URLs JSON

2026-05-03 00:40:52 +08:00

test_fetch_github_stars.py

fix: stricter GitHub owner/repo regexes and injection tests

2026-03-30 15:03:06 +08:00

test_readme_parser.py

fix(readme): rename group "Miscellaneous" to "Other"

2026-05-03 00:15:19 +08:00