maxim.dolgolyov/Learn_System
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(sim-builder): вайтлист цветов в validateSpec — закрыть CSS-инъекцию в шаренных спеках (финальное ревью)

Browse Source
This commit is contained in:
Maxim Dolgolyov
2026-06-13 13:33:14 +03:00
parent 9bd40c5d1c
commit d8717d0fbd
2 changed files with 33 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
plans/sim-builder/PLAN.md
+4 -4
View File
@@ -62,7 +62,7 @@
| Phase 7: Classroom | fullstack | ✅ Done | ✅ | ✅ | ✅ |
## Final Review
- [ ] Comprehensive code review (final-reviewer)
- [ ] Security review (safe expression eval, ownership, sanitization)
- [ ] Full test suite passes (within baseline)
- [ ] Merged to `master`
- [x] Comprehensive code review (final-reviewer) — READY TO MERGE, 0 critical
- [x] Security review — движок выражений безопасен (нет eval/доступа к globals), ownership/IDOR ок, SQL параметризован; ФИКС: вайтлист цветов в validateSpec (CSS-инъекция `color/bg` через style.cssText закрыта)
- [x] Full test suite passes (within baseline) — custom-sims 39/39; общий 241/249 (8 = baseline: 3 auth + 5 jsdom page)
- [ ] Merged to `master` — ОЖИДАЕТ одобрения пользователя