Johannes Millan 4d8605baa3 fix(security): harden XSS sinks and add Origin check (#7413) ... Address Snyk findings raised in discussion #7413: - error-handler: inject error title, additionalLog, stackTrace, and meta into the global error alert via textContent/setAttribute instead of innerHTML interpolation. Also fixes a latent <h2> close-tag typo. - break-reminder-overlay: use textContent (not innerHTML) for the reminder message; switch to decodeURIComponent to match a producer- side encodeURIComponent change (also fixes a latent parse bug for messages containing & or =). - local-rest-api: reject any request that arrives with a web Origin header. Closes the simple-POST CSRF gap (text/plain bodies are not preflighted by CORS) on top of the existing Host allowlist. The Snyk findings on Google OAuth CLIENT_SECRET (Desktop client per RFC 8252) and proxy-agent rejectUnauthorized (opt-in for self-hosted WebDAV with self-signed certs) are documented false positives and intentional, respectively; both already carry explanatory comments.		2026-05-06 21:37:06 +02:00
..
break-reminder-overlay.html	fix(security): harden XSS sinks and add Origin check (#7413)	2026-05-06 21:37:06 +02:00