Skip to content

Implement XSS mitigations for report and dataload names #561

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
Rello wants to merge 1 commit into from
Closed

Implement XSS mitigations for report and dataload names #561

Rello wants to merge 1 commit into from

Conversation

@Rello
Copy link
Owner

@Rello Rello commented Dec 19, 2025

Summary

  • add a SECURITY_REVIEW describing stored XSS vectors in dataset status and dataload views with mitigation recommendations
  • escape rendered report and dataload names and sanitize stored names when creating, updating, copying, or importing reports and dataloads
  • update the changelog to record the new security fixes and review documentation

Testing

  • Not run (not requested)

Codex Task

@Rello Rello closed this Dec 27, 2025
@Rello Rello deleted the codex/investigate-app-for-security-risks branch December 27, 2025 15:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

codex

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@Rello