- live editor: bind server and checkPortInUse to 127.0.0.1 instead
of 0.0.0.0. The dev server, the live editor, and the port probe
no longer expose themselves to the LAN by default. LAN access is
opt-in via DOCMD_HOST=0.0.0.0 or --host 0.0.0.0, with a TUI warning
when active.
- utils/html-escape: scriptLiteral and jsonInject now properly escape
the </script> sequence, <!--, U+2028, and U+2029. The old
implementation was a bare JSON.stringify which is unsafe in inline
<script> contexts. The hardening is silent for non-conflicting
strings; round-trips through JSON.parse still work because the
escape uses JSON-safe sequences.
- utils/test: update the html-escape tests to assert the new escape
behaviour (was asserting the old broken behaviour).
- docker/DOCKER.md: replace the three 'command: dev --host 0.0.0.0'
examples with the new loopback default. The Network Issues
troubleshooting section now documents the opt-in path with a
security note.
- Closes the security issues raised in the recent cold-email
advisory. The OpenAPI plugin CWE-22 and dev-server WebSocket
CWE-1385 were already fixed in 0.8.8 and remain in place.
Ghazi
43699f68e2