jwinterm a664a8bbce security: escape XSS sinks client-side and add CSP + security headers ...

The client trusted the server to pre-escape chat content and rendered
user-supplied fields via .html()/innerHTML — one server regression away from
stored XSS, and the admin panel injected user-controlled payout addresses
into its authenticated DOM.

- Add a single shared escapeHtml helper (escapes all five HTML-significant
  chars including both quotes); leaderboard now delegates to it.
- Escape chat username + message in onChatBroadcast/onChatHistory.
- Escape user-controlled fields in the admin panel (payout address, socket
  id, player name, status) and make its local escapeHtml quote-safe so values
  in title="..." can't break out.
- Add CSP plus X-Content-Type-Options, X-Frame-Options and Referrer-Policy
  headers via middleware. connect-src 'self' keeps Socket.IO working;
  removing 'unsafe-inline' (nonces) is tracked as a later cleanup.

Full suite: 13 suites / 119 tests.

2026-05-31 09:40:34 -04:00

..

escapeHtml.js

security: escape XSS sinks client-side and add CSP + security headers

2026-05-31 09:40:34 -04:00

game.js

fix single game payment flow and tests

2026-01-08 15:57:47 -05:00

gameState.js

refactor frontend and fix debug mode

2025-05-29 13:40:44 -04:00

options.js

add early entry and help screens for new users

2025-12-26 10:21:25 -05:00