Vinta Chen 704332271b fix(website): escape </script> in embedded filter URLs JSON ... `| safe` bypasses Jinja autoescape. If a category name ever contained "</script>", the literal substring would close the script block early, leaking JSON content into the DOM and creating an XSS vector. Replace "</" with "<\\/" (still valid JSON) and pass ensure_ascii=False so non-ASCII names render readably. Also add a group_path() helper to parallel category_path()/subcategory_path() and reuse category_urls when seeding filter_urls. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>		2026-05-03 00:40:52 +08:00
..
static	style(website): add CSS for category-breadcrumb and assert absence on parent	2026-05-03 00:30:56 +08:00
templates	feat(website): embed filter-to-url map in index for client routing	2026-05-03 00:36:41 +08:00
tests	fix(website): escape </script> in embedded filter URLs JSON	2026-05-03 00:40:52 +08:00
build.py	fix(website): escape </script> in embedded filter URLs JSON	2026-05-03 00:40:52 +08:00
fetch_github_stars.py	refactor: replace manual total_seconds()/3600 with timedelta comparison	2026-04-19 22:02:14 +08:00
readme_parser.py	add missing links of category descriptions	2026-05-02 23:35:24 +08:00