ambitgraph 0.8.3__tar.gz → 0.8.4__tar.gz

{ambitgraph-0.8.3/ambitgraph.egg-info → ambitgraph-0.8.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ambitgraph
-Version: 0.8.3
+Version: 0.8.4
 Summary: Read-only codebase scan: reusable units, families, roles, ownership candidates, duplication.
 Author: AmbitGraph
 License: Proprietary

{ambitgraph-0.8.3 → ambitgraph-0.8.4}/ambitgraph/omniscient_next/__init__.py

@@ -140,7 +140,13 @@ def render_screen(run_path: str) -> str:
     scripts (modules + payload + wiring). The caller (shell.py) owns the
     absence branch; calling this without data is a build error."""
     data = build_data(run_path)
-    payload = json.dumps(data, separators=(",", ":")).replace("</", "<\\/")
+    # EVERY `<` becomes an escaped unicode point, not just the ones that open a
+    # closing tag. Replacing `</` alone defends against `</script>` and against
+    # nothing else: a scanned name containing `<!--` opens a comment inside the
+    # script block and swallows the payload after it, and `<script` opens a
+    # second one. The escape is invisible to JSON.parse, so the data a reader
+    # gets is unchanged -- this is the cockpit's own pattern, not a new one.
+    payload = json.dumps(data, separators=(",", ":")).replace("<", "\\u003c")
     return (
         '<div class="cp-next-shell">'
         '<div class="sh-top">'

{ambitgraph-0.8.3 → ambitgraph-0.8.4}/ambitgraph/omniscient_next/graph.js

@@ -153,7 +153,13 @@ class SingleGraph {
   destroy(){ this.container.innerHTML=""; }
 
   /* ---------------- internals ---------------- */
-  _esc(s){ return String(s).replace(/&/g,"&amp;").replace(/</g,"&lt;"); }
+  /* All five characters that change how markup is read. This pane writes a
+     folder's name into data-expand="...", so an unescaped quote in a directory
+     name ends that attribute early and the rest of the name is read as markup.
+     The ampersand is replaced FIRST, or a later substitution's own output is
+     escaped a second time. */
+  _esc(s){ return String(s).replace(/&/g,"&amp;").replace(/</g,"&lt;")
+    .replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&#39;"); }
 
   _neigh(applyFilter=true){
     // inbound/outbound entries, deduped per file, weights summed
@@ -214,7 +220,7 @@ class SingleGraph {
          '<div class="sg-e-name"><span class="sg-e-dot" style="background:'+
            (FC[n.f]||"#8b96a8")+'"></span>'+esc(n.id.split("/").pop())+'</div>'+
          '<div class="sg-e-path">'+esc(n.id)+'</div>'+
-         '<div class="sg-e-meta">'+n.d+' links · '+n.in+' inbound · '+n.f+'/</div></div>'; });
+         '<div class="sg-e-meta">'+n.d+' links · '+n.in+' inbound · '+esc(n.f)+'/</div></div>'; });
     h+='</div></div>';
     this._canvas.innerHTML=h;
   }

{ambitgraph-0.8.3 → ambitgraph-0.8.4}/ambitgraph/omniscient_next/library.js

@@ -74,7 +74,13 @@ class LibraryView {
     if (i >= 0) { this._state = {...this._state, level:"file", file:i}; this._render(); } }
   home() { this._state = {...this._state, level:"home"}; this._render(); }
 
-  _esc(s){ return String(s).replace(/&/g,"&amp;").replace(/</g,"&lt;"); }
+  /* All five characters that change how markup is read. Two are enough for
+     text between tags and are no defence at all for a value placed inside a
+     quoted attribute, where one unescaped quote ends the attribute early and
+     everything after it is read as markup. The ampersand is replaced FIRST,
+     or a later substitution's own output is escaped a second time. */
+  _esc(s){ return String(s).replace(/&/g,"&amp;").replace(/</g,"&lt;")
+    .replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&#39;"); }
   _cat(key){ return this._CATS.find(c => c[0] === key); }
 
   _click(e) {

{ambitgraph-0.8.3 → ambitgraph-0.8.4}/ambitgraph/omniscient_next/search.js

@@ -61,7 +61,12 @@ class SearchDrop {
     if (m.syms.length) { return this._data.nodes[m.syms[0][1]].id; }
     return null;
   }
-  _esc(s) { return String(s).replace(/&/g, "&amp;").replace(/</g, "&lt;"); }
+  /* All five characters that change how markup is read. Two are enough for
+     text between tags and are no defence at all for a value placed inside a
+     quoted attribute. The ampersand is replaced FIRST, or a later
+     substitution's own output is escaped a second time. */
+  _esc(s) { return String(s).replace(/&/g, "&amp;").replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;"); }
   _render() {
     const SEARCH_ROW_CAP = 12;
     const m = this.matches(this._input.value);

{ambitgraph-0.8.3 → ambitgraph-0.8.4}/ambitgraph/omniscient_next/siderail.js

@@ -3,6 +3,17 @@
    navigation lands (a test pins that retirement). Architecture constraints:
    one view, one class, all CSS class names prefixed to avoid collisions,
    and only the documented public surface is used. */
+/* All five characters that change how markup is read. This module had none:
+   its labels and notes are file and folder names from the scanned repository
+   and they were written straight into innerHTML, so a name decided markup on
+   a page that opens by default. The ampersand is replaced FIRST, or a later
+   substitution's own output is escaped a second time.
+   The name is module-local because every module is concatenated into one
+   script and a bare `esc` would collide; one shared escaper replacing all of
+   these is the next release's work, not this patch's. */
+function _srEsc(s){ return String(s).replace(/&/g,"&amp;").replace(/</g,"&lt;")
+  .replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&#39;"); }
+
 /* ============================================================
    SideRail — the left rail with NESTED quick-nav: entry points
    nested under Graph, categories under Library, each group
@@ -36,8 +47,8 @@ class SideRail {
       b.className = "sr-item"; b.tabIndex = 0; b.setAttribute("role", "button");
       b.innerHTML =
         (it.children ? "<span class='sr-caret'>▸</span>" : "<span class='sr-caret sr-blank'></span>") +
-        "<span class='sr-label'>" + it.label + "</span>" +
-        (it.note ? "<span class='sr-note'>" + it.note + "</span>" : "");
+        "<span class='sr-label'>" + _srEsc(it.label) + "</span>" +
+        (it.note ? "<span class='sr-note'>" + _srEsc(it.note) + "</span>" : "");
       const switchTo = () => { if (typeof opts.onSwitch === "function") opts.onSwitch(it.key); };
       b.querySelector(".sr-label").onclick = switchTo;
       if (it.note) b.querySelector(".sr-note").onclick = switchTo;
@@ -58,9 +69,9 @@ class SideRail {
         it.children.forEach(c => {
           const k = document.createElement("div");
           k.className = "sr-kid"; k.tabIndex = 0; k.setAttribute("role", "button");
-          k.innerHTML = (c.color ? "<span class='sr-dot' style='background:"+c.color+"'></span>" : "") +
-            "<span class='sr-klabel'>" + c.label + "</span>" +
-            (c.note ? "<span class='sr-note'>" + c.note + "</span>" : "");
+          k.innerHTML = (c.color ? "<span class='sr-dot' style='background:"+_srEsc(c.color)+"'></span>" : "") +
+            "<span class='sr-klabel'>" + _srEsc(c.label) + "</span>" +
+            (c.note ? "<span class='sr-note'>" + _srEsc(c.note) + "</span>" : "");
           k.onclick = () => c.onClick && c.onClick();
           k.addEventListener("keydown", e => { if (e.key === "Enter") k.onclick(); });
           kids.appendChild(k);

{ambitgraph-0.8.3 → ambitgraph-0.8.4}/ambitgraph/omniscient_next/wholemap.js

@@ -2,6 +2,17 @@
    implementation and is expected to be retired once the map product view
    ships (a test pins this until then). Architecture constraints: one view,
    one class, CSS prefixed to this module, public surface only. */
+/* All five characters that change how markup is read. This module had none:
+   the folder legend wrote a scanned folder's name straight into innerHTML, on
+   the pane the page opens on, so the name decided markup with no click at all.
+   The ampersand is replaced FIRST, or a later substitution's own output is
+   escaped a second time.
+   The name is module-local because every module is concatenated into one
+   script and a bare `esc` would collide; one shared escaper replacing all of
+   these is the next release's work, not this patch's. */
+function _wmEsc(s){ return String(s).replace(/&/g,"&amp;").replace(/</g,"&lt;")
+  .replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&#39;"); }
+
 /* ============================================================
    WholeMap — the whole-graph view, as its own module.
 
@@ -471,8 +482,8 @@ class WholeMap {
     /* chips — computed from THIS repo's data, never assumed */
     data.folders.forEach(f=>{ const [name,count]=f;
       const el=document.createElement("span"); el.className="wm-chip"; el.tabIndex=0;
-      el.innerHTML="<span class='wm-sw' style='background:"+folderColor[name]+"'></span>"
-        +name+" "+count;
+      el.innerHTML="<span class='wm-sw' style='background:"+_wmEsc(folderColor[name])+"'></span>"
+        +_wmEsc(name)+" "+count;
       el.onclick=()=>{ traced = traced===name? null : name;
         chipbar.querySelectorAll(".wm-chip").forEach(c=>c.classList.remove("wm-on"));
         if(traced) el.classList.add("wm-on");

{ambitgraph-0.8.3 → ambitgraph-0.8.4/ambitgraph.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ambitgraph
-Version: 0.8.3
+Version: 0.8.4
 Summary: Read-only codebase scan: reusable units, families, roles, ownership candidates, duplication.
 Author: AmbitGraph
 License: Proprietary

{ambitgraph-0.8.3 → ambitgraph-0.8.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "ambitgraph"
-version = "0.8.3"
+version = "0.8.4"
 description = "Read-only codebase scan: reusable units, families, roles, ownership candidates, duplication."
 readme = "README.md"
 requires-python = ">=3.11"