David/HERMES-GIELIE
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
HERMES-GIELIE/api
History
Nathan Esquenazi 71dd691ed0 fix: harden bot_name — crash guard, XSS escape, sanitization, tests 
- Move `import html` to module top (was inside function body)
- Fix IndexError crash in /login when bot_name is empty string;
  use `or 'Hermes'` fallback instead of .get() default which
  doesn't guard against stored empty string
- Add server-side sanitization in POST /api/settings: strip + default
  empty/whitespace bot_name to 'Hermes' before persisting
- Escape _bn initial char in ui.js innerHTML (esc() consistency)
- Add maxlength=64 to #settingsBotName input field
- Add tests/test_sprint27.py: 9 tests covering API round-trip,
  empty/whitespace defaults, login page rendering, and XSS escaping
2026-04-06 15:06:16 +00:00
..
__init__.py Hermes Web UI — Sprints 11-14: multi-provider models, settings, session QoL, alerts, polish 2026-03-31 07:02:47 +00:00
auth.py fix: correct 9 inaccurate type hints 2026-04-04 23:54:58 -07:00
config.py feat: make bot name configurable 2026-04-06 05:14:31 +00:00
helpers.py chore: add missing type hints across 10 files 2026-04-05 13:30:20 +07:00
models.py fix: correct 9 inaccurate type hints 2026-04-04 23:54:58 -07:00
profiles.py chore: add missing type hints across 10 files 2026-04-05 13:30:20 +07:00
routes.py fix: harden bot_name — crash guard, XSS escape, sanitization, tests 2026-04-06 15:06:16 +00:00
state_sync.py fix: correct 9 inaccurate type hints 2026-04-04 23:54:58 -07:00
streaming.py security: fix env race, signing key, upload traversal, password hash (#106) 2026-04-04 22:25:08 -07:00
updates.py fix: apply_update concurrency lock, boot.js settings-fail guard, dead workspace code, test_updates URL param 2026-04-05 16:20:12 +00:00
upload.py chore: add missing type hints across 10 files 2026-04-05 13:30:20 +07:00
workspace.py chore: add missing type hints across 10 files 2026-04-05 13:30:20 +07:00