3 Commits

Include renames

Author	SHA1	Message	Date
Alex Holliday	9001a8d294	add tests	2026-08-17 12:58:56 -07:00
Buco7854	3685e0c476	feat: reject custom CSS that references external resources ... Reject status page custom CSS containing @import or a url() / image-set() / image() / cross-fade() whose target is http(s) or protocol-relative, while allowing data: and relative URLs. The check normalizes comments and CSS escapes first so obfuscated forms cannot slip past. Enforced in the create/update body validation.	2026-06-22 23:49:58 +00:00
Buco7854	0f4240d3db	feat: cap custom CSS length and add validation tests ... Bound customCSS to 100000 characters on both the client schema and the server body validation (the server is the enforcement boundary; multer's 1MB field cap was the only limit), regenerate the OpenAPI spec, and add a validation test suite covering acceptance, clearing, the length cap, and type rejection.	2026-06-10 17:02:17 +02:00