skizy/untangle-01-security #11

Merged

V merged 2 commits from skizy/untangle-01-security into main

2026-10-21 14:44:50 -07:00

skizy commented

2026-10-21 14:44:21 -07:00

Member

security fixes

skizy added 2 commits

2026-10-21 14:44:21 -07:00

Letters and bottles can't carry hidden code any more: a link or pictu... (+2 more) fb7e1eda1c

- Letters and bottles can't carry hidden code any more: a link or picture in one only goes to a web address, an email or the site's own files, and a quote mark can't break out of it (Sky.txtToHtml in sky/sky.js, the desk's preview in sky/desk.js, the content manager's in tools/letters.html). Before this, a visitor's bottle, once kept, could have run a stranger's script for everyone in the living space.
- The bottle from Claude (content/living/bottles/2026-10-11-from-claude.txt) says "the artist" now instead of a name.
- sky/hand.js has a ?v= on index.html and template.html: publishing only refreshes stamps that are already there, so it never had one and visitors' browsers could keep an old copy.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

AGENTS.md, GEMINI.md and tools/FOR-ARGON.md have the bottle rule too... 31bc97f27f

- AGENTS.md, GEMINI.md and tools/FOR-ARGON.md have the bottle rule too (escape quotes, safe() links in all three letter renderers), so every helper working on the site knows it, not only Claude.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>