Vinta Chen 704332271b fix(website): escape </script> in embedded filter URLs JSON ... `| safe` bypasses Jinja autoescape. If a category name ever contained "</script>", the literal substring would close the script block early, leaking JSON content into the DOM and creating an XSS vector. Replace "</" with "<\\/" (still valid JSON) and pass ensure_ascii=False so non-ASCII names render readably. Also add a group_path() helper to parallel category_path()/subcategory_path() and reuse category_urls when seeding filter_urls. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>		2026-05-03 00:40:52 +08:00
..
test_build.py	fix(website): escape </script> in embedded filter URLs JSON	2026-05-03 00:40:52 +08:00
test_fetch_github_stars.py	fix: stricter GitHub owner/repo regexes and injection tests	2026-03-30 15:03:06 +08:00
test_readme_parser.py	fix(readme): rename group "Miscellaneous" to "Other"	2026-05-03 00:15:19 +08:00