v0.9.6: SPARQL input hardening; query_sparql cap disclosure + full-term output
SPARQL input hardening; query_sparql cap disclosure + full-term output
Caller-supplied SPARQL literals and IRIs across every tool and resource now route through shared escaping and validation, closing the paths that leaked raw Virtuoso SP030 compiler errors.
Security:
- escapeSparqlLiteral escapes \n/\r/\t; the two eurlex://document resources and the browse_subjects / get_cases / search_documents keyword sites now call it instead of a quote-only pass (#61, #62)
- isSafeSparqlIri (http prefix, rejects /[\s<>"]/) guards work_uri on get_document + get_relations and eurovoc_concept on search_documents, replacing three divergent hand-rolled guards (#53, #60)
Added:
- eurlex_query_sparql discloses a capped result via an enrichment block (truncated / shown / cap) (#52)
Fixed:
- eurlex_query_sparql text output renders full SPARQL terms — , "lex"@en, "lex"^^xsd:date — instead of bare values (#54)
Dependency bumps:
- @biomejs/biome (dev) 2.5.2 → 2.5.3
- @types/node (dev) 26.1.0 → 26.1.1
- ignore (dev) ^7.0.5 → ^7.0.6
371 tests pass; bun run devcheck clean.
