fix(security): sanitize HTML sinks + block non-http(s) hrefs (P4.1/P4.2) - #51

Merged

franciszver merged 3 commits into

mainfrom

fix/p4-frontend-xss

Jul 24, 2026

Commits on Jul 24, 2026

test(security): red — XSS sinks unsanitized, javascript: href unblocked (#47 #48)

franciszver
and
claude
committed
9204b57
fix(security): sanitize clause/citation HTML + block non-http(s) hrefs (#47 #48)

franciszver
and
claude
committed
73adaef
fix(security): sanitize remaining HTML sinks + guard CitationManager href (#47 #48)

franciszver
and
claude
committed
eb44cc7