Vijay Janapa Reddi 442dd3693b fix(security): reject non-http(s) hrefs in release-pill ...

The release pill assigned a data-link attribute straight to a.href, which
CodeQL flags as DOM XSS (js/xss-through-dom). Add a scheme allowlist so only
anchor, relative, and http(s) links pass; anything else such as javascript:
or data: falls back to #release.

2026-07-03 22:04:36 +02:00

..

assets/img

…

config

Site QA polish: finish MLSys.im brand migration, fix broken links, add memory-tier figure

2026-06-27 08:14:00 -04:00

release

fix(security): reject non-http(s) hrefs in release-pill

2026-07-03 22:04:36 +02:00

scripts

…

styles

Add end-of-chapter research questions

2026-07-01 12:23:48 -04:00