security: encode and sanitize values at frontend HTML sinks (24.05) - #7971

Open

ar2rsawseen wants to merge 6 commits into

release.24.05from

backport/xss-sink-hardening-2405

Commits on Aug 19, 2026

security(core): HTML-encode the application name in the graph note tooltip

ar2rsawseen
and
claude
committed
a4dab5d
security(push): sanitize message-editor content before it enters the contenteditable

ar2rsawseen
and
claude
committed
7d8a794
[security][compliance-hub] escape interpolated values in the export history actions column

ar2rsawseen
and
claude
committed
a1f5264
[security][populator] stop rendering decoded names as html in the delete confirmations

ar2rsawseen
and
claude
committed
be29430
security(core): escape "<" in the res.expose script island (stored XSS via app name)

ar2rsawseen
and
claude
committed
d2ca376
docs(changelog): consolidate XSS-sink security entries under the current version

ar2rsawseen
and
claude
committed
64eddae