Satoshi Qazi Muhammed c7eb0f157e fix(ui): leave no angle bracket in a sanitized origin; judge markup on the raw one ...

sanitizeOrigin removed tags in a single pass, so `<scr<script>ipt>`
came out as `<script` (CodeQL js/incomplete-multi-character-sanitization
#6, #7). The page renders the result as React text, so this was not
exploitable here, but the helper's name promised more than it did. It
now also drops every remaining `<` and `>`.

validateOrigin looked for markup in the sanitized string, after the tags
had been removed, so `<b>x</b>` passed as a valid origin. It now checks
the raw origin first.

pr-any.yml gets permissions: contents: read and lock.yml the
issues/pull-requests/discussions write it needs (CodeQL
actions/missing-workflow-permissions #3, #23).

2026-10-20 22:21:33 +04:00

..

workflows

fix(ui): leave no angle bracket in a sanitized origin; judge markup on the raw one

2026-10-20 22:21:33 +04:00

dependabot.yml

ci: let Dependabot keep the workflow actions current

2026-10-09 08:08:50 +04:00

issue_template.md

Update domain references to pezkuwichain.app and rebrand from polkadot

2026-01-06 12:21:11 +03:00