okf v0.3.6 — security: visualizer XSS fix

scaccogatto released this 17 Jul 10:04

· 39 commits to main since this release

270dd31

Security

visualize: concept-body markdown is now sanitized with DOMPurify (SRI-pinned) before innerHTML — a shared viz.html could previously execute script from a malicious concept body (stored XSS).

Fixed

validate/visualize: a binary or non-UTF-8 .md file now yields a per-file error/warning instead of crashing the whole run.

Added

CI: windows-latest job (real cp1252 console coverage) + XSS regression self-test.

Full Changelog: okf--v0.3.5...okf--v0.3.6

Assets 2