Doxa Maps 484f07382e Dev server: a leaf URL cannot write markup into the page it opens ... The dev leaf route wrote the URL's parts into the page's <title> and the element's profile-config attribute, refusing only .. and /. A quote or a tag in a crafted link broke out of the attribute on a publicly reachable dev server. Each part must now have the shape every bundle, profile and instance id has, before it reaches either; the title is escaped too. check:dev-leaf-escape drives the plugin's own middleware: every leaf the dev manifest advertises is still served in both URL forms, hostile parts are refused in every position, and the title escapes on its own.		2026-10-03 06:09:09 +00:00
..
dev-plugin.mjs	Dev server: a leaf URL cannot write markup into the page it opens	2026-10-03 06:09:09 +00:00
discover.mjs	consolidate docs into documentation/ and deployment shells into deployment/	2026-09-21 23:23:23 +00:00