6 Commits

Include renames

Author	SHA1	Message	Date
Buco7854	96021b7479	refactor: detect external CSS references with the CSS Syntax tokenizer ... Replace the regex/escape-normalizer with @csstools/css-tokenizer (already present transitively). Tokenizing resolves comments, hex escapes, and line continuations into the real value before scanning, so obfuscated forms (a scheme split by a line continuation or hex escape) cannot slip past. Scan url-tokens and string-tokens to cover url(), quoted @import, and string-form image functions. Add regression tests for the bypasses.	2026-06-23 19:25:18 +00:00
Buco7854	3685e0c476	feat: reject custom CSS that references external resources ... Reject status page custom CSS containing @import or a url() / image-set() / image() / cross-fade() whose target is http(s) or protocol-relative, while allowing data: and relative URLs. The check normalizes comments and CSS escapes first so obfuscated forms cannot slip past. Enforced in the create/update body validation.	2026-06-22 23:49:58 +00:00
Ian Troisi	a37bc63f31	Merge branch 'develop' into feat/status-page-custom-domain ... Resolve conflicts from server reorganization while preserving custom domain support for published status pages.	2026-06-10 10:55:59 -04:00
Alex Holliday	abec4e6c70	update tests	2026-06-09 12:34:30 -07:00
Ian Troisi	30e8cfc9ec	Add custom domain support for published status pages. ... Fixes #3647	2026-06-07 22:37:24 -04:00
Alex Holliday	abf66eed95	add logic for entering/leaving maintenance windows, add tests	2026-05-21 10:23:27 -07:00