Jason Woltje ef1f1eee9d fix(SEC-API-17): Block data: URI scheme in markdown renderer ...

Remove data: from allowedSchemesByTag for img tags and add transformTags
filters for both <a> and <img> elements that strip data: URI schemes
(including mixed-case and whitespace-padded variants). This prevents
XSS/CSRF attacks via embedded data URIs in markdown content.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-02-06 13:22:46 -06:00

..

api

fix(SEC-API-17): Block data: URI scheme in markdown renderer

2026-02-06 13:22:46 -06:00

coordinator

fix(#338): Sanitize issue body for prompt injection

2026-02-05 18:36:16 -06:00

orchestrator

fix(tests): Fix CI pipeline failures in pipeline 239

2026-02-06 12:25:54 -06:00

web

fix(CQ-WEB-3): Fix race condition in LinkAutocomplete

2026-02-06 13:18:23 -06:00