bvandeusenandClaude Opus 5.5
f47fc23265
#5099 "A name containing a quote runs script when an admin clicks Delete". Inline handlers like onclick="return confirm('Delete {{ rule.name }}?')" are HTML-decoded before the JavaScript is parsed, so autoescaping did not stop a name such as x');fetch(…);// from running. - Every prompt (22 handlers, plus the docker prune and token revoke ones) is now data-confirm="…", read through dataset by one submit listener in base.html; nothing rendered is parsed as JavaScript. - The remaining inline handlers take integers only (|int), and the time range buttons pass this.dataset.range. - tests/test_inline_handlers.py fails on any {{ }} in an inline handler that is not |int, with a self-test; tests/_templates.py is the one template walker the template guards now share. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
13 lines
427 B
Python
13 lines
427 B
Python
"""Where Steward's templates live, for the guards that read every one."""
|
|
import pathlib
|
|
|
|
import steward
|
|
|
|
REPO = pathlib.Path(steward.__file__).parent.parent
|
|
|
|
|
|
def template_files() -> list[pathlib.Path]:
|
|
"""Every first-party .html template: core and each plugin's."""
|
|
roots = [REPO / "steward" / "templates", *(REPO / "plugins").glob("*/templates")]
|
|
return sorted(p for root in roots for p in root.rglob("*.html"))
|