0162ec0cdf
Defense-in-depth for the public deploy: USGS/EONET place/title/category are now HTML-escaped before interpolation into Cesium InfoBox descriptions, and the USGS/EONET links are passed through lib.safeUrl (http(s)-only) so a hostile feed can't inject markup or a javascript:/data: href. Entity names/labels stay raw (Cesium renders those as text). Verified: escapeHtml neutralizes <img onerror>, safeUrl drops javascript:/data:, 219 quakes + 500 fires still render normally. ship-check pass: no auth surface (dev-only history/snap not deployed); no secrets in tree (AIS key empty, data/ gitignored); proxy upstreams are a fixed dict (no SSRF); no money paths. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| layers | ||
| config.js | ||
| lib.js | ||
| main.js | ||
| ui.js | ||