vvzvlad
f13d1507ad
Docker Image CI / build (pull_request) Has been cancelled
Issue #13: data["html"]["title"] was embedded into the debug HTML of /post/html without escaping; title never passes through bleach, so a post whose generated title carries markup (e.g. a poll question) was a reflected XSS under ?debug=true. Escape it with html.escape, same as raw_message. Add a regression test with a <script> payload in a poll question. Issue #17: a bare 'pytest' from the repo root failed 22 tests because the config in tests/pytest.ini was not picked up (asyncio_mode lost, .venv collected) and every test module polluted sys.modules['config'] at import time. Move the config to a root pytest.ini with testpaths=tests, and centralize the sys.path bootstrap + config mock in tests/conftest.py, which pytest imports before any test module. Drop the per-module preambles. Closes #13, closes #17 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>