nullrouten0andClaude Mythos 5.1 523a5edfa1 fix(ui): escape the route string on the unknown-route page (#2124) ...

`app.js` wrote the URL fragment into `innerHTML` as the heading of the
"Page not yet implemented" view for routes it does not know. Browsers
percent-encode `<`, `>` and `"` in fragments, so this is unlikely to be
exploitable today, but it is a plain `innerHTML` sink on a
URL-controlled string and costs one `escapeHtml()` to close.

**Tests:** one test added to `tests/unit/test-xss-escape-sinks.js` in
the file's existing style.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Mythos 5.1 <noreply@anthropic.com>

2026-10-08 15:56:30 +02:00

..

e2e

feat: sync a logged-in user's settings across devices (part B) (#2130)

2026-10-07 11:20:44 +02:00

unit

fix(ui): escape the route string on the unknown-route page (#2124)

2026-10-08 15:56:30 +02:00

a11y-allowlist.yaml

fix(#1715): dark-theme role swatches via per-theme CSS tokens (#1757)

2026-06-20 16:15:58 -07:00

emoji-allowlist.txt

fix(#1648): final emoji leaks — .obs-clock-naive-chip warning + analytics Channels encrypted group labels (#1665)

2026-06-11 18:29:30 -07:00