Émile Ré e24813202b Fix XSS in cookie banner translation rendering ...

Validate translation string values server-side with NoHTML() and
MaxLen(2000) to reject HTML in the translations JSON blob. On the
client side, escape user-provided template text before innerHTML
injection in banner_description and placeholder_text paths.

Signed-off-by: Émile Ré <emile@getprobo.com>

2026-04-24 12:18:11 +04:00

..

cookie-banner

Fix XSS in cookie banner translation rendering

2026-04-24 12:18:11 +04:00

coredata

Move document type from document to document version

2026-04-02 16:32:38 +02:00

emails

Add ISC license headers to Go, TypeScript, and SQL files

2026-03-31 13:31:30 +02:00

eslint-config

Remove --max-warnings from lint scripts

2026-04-06 13:33:51 +04:00

eslint-relay-plugin-types

Add ISC license headers to Go, TypeScript, and SQL files

2026-03-31 13:31:30 +02:00

helpers

Assets as document: replace snapshot with publish workflow

2026-04-21 19:36:17 +02:00

hooks

Add ISC license headers to Go, TypeScript, and SQL files

2026-03-31 13:31:30 +02:00

i18n

Add ISC license headers to Go, TypeScript, and SQL files

2026-03-31 13:31:30 +02:00

n8n-node

Add missing resources to CLI, MCP, and n8n surfaces

2026-04-22 19:02:22 +02:00

prosemirror

Bump dompurify from 3.3.3 to 3.4.0

2026-04-16 07:21:48 +00:00

react-lazy

Add ISC license headers to Go, TypeScript, and SQL files

2026-03-31 13:31:30 +02:00

relay

Upgrade Relay to v20.1.1 and unify compiler config

2026-04-14 16:04:11 +04:00

routes

Upgrade Relay to v20.1.1 and unify compiler config

2026-04-14 16:04:11 +04:00

tsconfig

Move vendors in a dedicated package

2025-05-01 14:49:32 -07:00

ui

Use fragment and add confirm

2026-04-21 11:40:22 +04:00

vendors

Add ISC license headers to Go, TypeScript, and SQL files

2026-03-31 13:31:30 +02:00