Vinta Chen 704332271b fix(website): escape </script> in embedded filter URLs JSON ...

`| safe` bypasses Jinja autoescape. If a category name ever contained
"</script>", the literal substring would close the script block early,
leaking JSON content into the DOM and creating an XSS vector. Replace
"</" with "<\\/" (still valid JSON) and pass ensure_ascii=False so
non-ASCII names render readably. Also add a group_path() helper to
parallel category_path()/subcategory_path() and reuse category_urls
when seeding filter_urls.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-03 00:40:52 +08:00

..

static

style(website): add CSS for category-breadcrumb and assert absence on parent

2026-05-03 00:30:56 +08:00

templates

feat(website): embed filter-to-url map in index for client routing

2026-05-03 00:36:41 +08:00

tests

fix(website): escape </script> in embedded filter URLs JSON

2026-05-03 00:40:52 +08:00

build.py

fix(website): escape </script> in embedded filter URLs JSON

2026-05-03 00:40:52 +08:00

fetch_github_stars.py

refactor: replace manual total_seconds()/3600 with timedelta comparison

2026-04-19 22:02:14 +08:00

readme_parser.py

add missing links of category descriptions

2026-05-02 23:35:24 +08:00