From fad4b73b50ca621f7728adde341a65ed6c8d5724 Mon Sep 17 00:00:00 2001 From: Egor Merkushev Date: Thu, 19 Feb 2026 11:15:49 +0300 Subject: [PATCH 1/8] Branch for FU-P12-T1-6: uniform html escaping client widgets From 29876e648368ca2ae4d253f6c3b2825df0fd1eda Mon Sep 17 00:00:00 2001 From: Egor Merkushev Date: Thu, 19 Feb 2026 11:16:04 +0300 Subject: [PATCH 2/8] Select task FU-P12-T1-6: Uniform HTML escaping in renderClientWidgets --- SPECS/INPROGRESS/next.md | 27 +++++++++++++++------------ 1 file changed, 15 insertions(+), 12 deletions(-) diff --git a/SPECS/INPROGRESS/next.md b/SPECS/INPROGRESS/next.md index b099b699..004104aa 100644 --- a/SPECS/INPROGRESS/next.md +++ b/SPECS/INPROGRESS/next.md @@ -1,16 +1,19 @@ -# No Active Task +# Next Task: FU-P12-T1-6 — Uniform HTML escaping in `renderClientWidgets` -## Recently Archived +**Priority:** P3 +**Phase:** Phase 13: Post-Release Follow-ups +**Effort:** 1-2 hours +**Dependencies:** FU-P12-T1-3 +**Status:** Selected -- 2026-02-19 — FU-P12-T1-5: Cap `_clients` dict and prune `client_identities` to prevent unbounded growth (PASS) -- 2026-02-19 — FU-P12-T1-4: Make `IN FLIGHT` KPI reflect real in-flight requests in shared-metrics mode (PASS) -- 2026-02-19 — FU-P12-T3-2: Add `error_code` column to audit CSV export (PASS) -- 2026-02-18 — FU-P12-T1-3: Show multi-client widgets in Web UI instead of single overwritten active client (PASS) -- 2026-02-18 — FU-P12-T1-2: Add code comment clarifying stdin-only client capture in `on_request` (PASS) -- 2026-02-18 — FU-P12-T1-1: Remove or document `MCPInitializeParams` in schemas (PASS) +## Description -## Suggested Next Tasks +In `dashboard.js`, `renderClientWidgets` currently interpolates `count` and +`lastSeen` values directly into `innerHTML` while `name` and `version` are +escaped. Apply `escapeHtml()` uniformly to all interpolated widget values to +keep rendering behavior and security posture consistent. -- P13-T5 follow-up — Complete interactive prompt verification in a desktop session (P1) -- FU-P12-T1-6 — Uniform HTML escaping in `renderClientWidgets` (P3) -- FU-P12-T3-1 — Document unused `error_message` parameter in `MetricsCollector.record_response` (P3) +## Next Step + +Run the PLAN command to create the task PRD with implementation details, +acceptance criteria, and validation gates. From 862af321426e11613dd7d4d9bc6ddb2673bcb851 Mon Sep 17 00:00:00 2001 From: Egor Merkushev Date: Thu, 19 Feb 2026 11:16:23 +0300 Subject: [PATCH 3/8] Plan task FU-P12-T1-6: Uniform HTML escaping in renderClientWidgets --- ...rm_HTML_escaping_in_renderClientWidgets.md | 81 +++++++++++++++++++ 1 file changed, 81 insertions(+) create mode 100644 SPECS/INPROGRESS/FU-P12-T1-6_Uniform_HTML_escaping_in_renderClientWidgets.md diff --git a/SPECS/INPROGRESS/FU-P12-T1-6_Uniform_HTML_escaping_in_renderClientWidgets.md b/SPECS/INPROGRESS/FU-P12-T1-6_Uniform_HTML_escaping_in_renderClientWidgets.md new file mode 100644 index 00000000..65a86e39 --- /dev/null +++ b/SPECS/INPROGRESS/FU-P12-T1-6_Uniform_HTML_escaping_in_renderClientWidgets.md @@ -0,0 +1,81 @@ +# PRD: FU-P12-T1-6 — Uniform HTML escaping in `renderClientWidgets` + +**Created:** 2026-02-19 +**Priority:** P3 +**Branch:** `codex/feature/FU-P12-T1-6-uniform-html-escaping-client-widgets` +**Status:** PLAN + +--- + +## 1. Problem Statement + +`renderClientWidgets` in the dashboard escapes `name` and `version`, but does +not consistently escape all interpolated values (`count`, `lastSeen`) before +injecting HTML. This asymmetric pattern is low risk today but increases review +and audit complexity. + +--- + +## 2. Scope + +### In Scope +- Update `renderClientWidgets` so all interpolated values are passed through + `escapeHtml()`. +- Add or update frontend tests to verify escaping is applied uniformly. + +### Out of Scope +- Dashboard visual redesign. +- Backend metrics payload changes. +- Changes to `formatRelativeAge` behavior. + +--- + +## 3. Deliverables + +1. Uniform escaping in client widget rendering +- `src/mcpbridge_wrapper/webui/static/dashboard.js` +- Ensure `count` and `lastSeen` paths use `escapeHtml()` consistently. + +2. Test coverage +- `tests/unit/webui/static/test_dashboard.js` +- Add/update assertions for escaped rendering values. + +3. Validation artifact +- `SPECS/INPROGRESS/FU-P12-T1-6_Validation_Report.md` + +--- + +## 4. Acceptance Criteria + +- [ ] All interpolated values in `renderClientWidgets` are escaped. +- [ ] No visual/behavioral regression in client widget rendering. +- [ ] `pytest` passes. +- [ ] `ruff check src/` passes. +- [ ] `mypy src/` passes. +- [ ] `pytest --cov` reports coverage >= 90%. + +--- + +## 5. Dependencies + +- FU-P12-T1-3 ✅ + +--- + +## 6. Risks and Mitigations + +- **Risk:** Escaping numeric values may alter formatting unexpectedly. + - **Mitigation:** Keep formatting conversion stable (`String(...)`) and verify + rendered output via tests. + +- **Risk:** Duplicate escaping for derived strings could change displayed text. + - **Mitigation:** Escape at the final interpolation boundary and validate with + existing widget rendering tests. + +--- + +## 7. Validation Plan + +1. Apply uniform escaping in `renderClientWidgets`. +2. Add/update tests for escaped output paths. +3. Run full quality gates and capture results. From 5e7771e85e9570494850ba09cdee6c51b7aa891a Mon Sep 17 00:00:00 2001 From: Egor Merkushev Date: Thu, 19 Feb 2026 11:18:15 +0300 Subject: [PATCH 4/8] Implement FU-P12-T1-6: apply uniform escaping in client widget rendering --- .../FU-P12-T1-6_Validation_Report.md | 39 +++++++++++++++++++ .../webui/static/dashboard.js | 6 ++- tests/unit/webui/test_server.py | 9 +++++ 3 files changed, 52 insertions(+), 2 deletions(-) create mode 100644 SPECS/INPROGRESS/FU-P12-T1-6_Validation_Report.md diff --git a/SPECS/INPROGRESS/FU-P12-T1-6_Validation_Report.md b/SPECS/INPROGRESS/FU-P12-T1-6_Validation_Report.md new file mode 100644 index 00000000..1c51c072 --- /dev/null +++ b/SPECS/INPROGRESS/FU-P12-T1-6_Validation_Report.md @@ -0,0 +1,39 @@ +# Validation Report — FU-P12-T1-6 + +**Task:** FU-P12-T1-6 — Uniform HTML escaping in `renderClientWidgets` +**Date:** 2026-02-19 +**Verdict:** PASS + +## Scope + +- Applied uniform escaping in `renderClientWidgets` so `count` and `lastSeen` + are escaped before interpolation into `innerHTML`. +- Added a static-asset test verifying `dashboard.js` contains the escaped + interpolation path for these widget values. + +## Files Changed + +- `src/mcpbridge_wrapper/webui/static/dashboard.js` +- `tests/unit/webui/test_server.py` + +## Required Quality Gates + +- `pytest` + - Result: **PASS** (`594 passed, 5 skipped, 2 warnings`) +- `ruff check src/` + - Result: **PASS** (`All checks passed!`) +- `mypy src/` + - Result: **PASS** (`Success: no issues found in 18 source files`) +- `pytest --cov` + - Result: **PASS** (`594 passed, 5 skipped, 2 warnings`; total coverage **92.18%**, threshold 90%) + +## Acceptance Criteria Status + +- [x] All interpolated values in `renderClientWidgets` are passed through `escapeHtml()`. +- [x] No visual regression in client widget rendering. +- [x] `pytest` suite remains green. + +## Notes + +- Existing third-party deprecation warnings from `websockets` / `uvicorn` were + observed during test runs and are unrelated to this task. diff --git a/src/mcpbridge_wrapper/webui/static/dashboard.js b/src/mcpbridge_wrapper/webui/static/dashboard.js index b8347ba3..dd1823f9 100644 --- a/src/mcpbridge_wrapper/webui/static/dashboard.js +++ b/src/mcpbridge_wrapper/webui/static/dashboard.js @@ -227,10 +227,12 @@ var version = client.version || "unknown"; var count = client.initialize_count || 0; var lastSeen = formatRelativeAge(client.last_seen); + var escapedCount = escapeHtml(String(count)); + var escapedLastSeen = escapeHtml(String(lastSeen)); return "
" + "
" + escapeHtml(name) + " " + escapeHtml(version) + "
" - + "
Initialize calls: " + count + "
" - + "
Last seen: " + escapeHtml(lastSeen) + "
" + + "
Initialize calls: " + escapedCount + "
" + + "
Last seen: " + escapedLastSeen + "
" + "
"; }).join(""); } diff --git a/tests/unit/webui/test_server.py b/tests/unit/webui/test_server.py index b327f053..0fa51796 100644 --- a/tests/unit/webui/test_server.py +++ b/tests/unit/webui/test_server.py @@ -159,6 +159,15 @@ def test_dashboard_served(self, client): assert "/static/dashboard.css" in response.text assert "/static/dashboard.js" in response.text + def test_dashboard_js_uses_uniform_client_widget_escaping(self, client): + """Client widget interpolations in dashboard.js use escapeHtml uniformly.""" + response = client.get("/static/dashboard.js") + assert response.status_code == 200 + assert "Initialize calls: \" + escapedCount + \"" in response.text + assert "Last seen: \" + escapedLastSeen + \"" in response.text + assert "var escapedCount = escapeHtml(String(count));" in response.text + assert "var escapedLastSeen = escapeHtml(String(lastSeen));" in response.text + def test_websocket_metrics_update_includes_sessions(self, client, audit): """WebSocket metrics_update message includes sessions key.""" with client.websocket_connect("/ws/metrics") as websocket: From 21055455f40bfeabf61ca79bd5224664d6a99fde Mon Sep 17 00:00:00 2001 From: Egor Merkushev Date: Thu, 19 Feb 2026 11:19:53 +0300 Subject: [PATCH 5/8] Archive task FU-P12-T1-6: Uniform HTML escaping in renderClientWidgets (PASS) --- ...rm_HTML_escaping_in_renderClientWidgets.md | 4 +++ .../FU-P12-T1-6_Validation_Report.md | 0 SPECS/ARCHIVE/INDEX.md | 4 ++- SPECS/INPROGRESS/next.md | 27 +++++++++---------- SPECS/Workplan.md | 9 ++++--- 5 files changed, 24 insertions(+), 20 deletions(-) rename SPECS/{INPROGRESS => ARCHIVE/FU-P12-T1-6_Uniform_HTML_escaping_in_renderClientWidgets}/FU-P12-T1-6_Uniform_HTML_escaping_in_renderClientWidgets.md (97%) rename SPECS/{INPROGRESS => ARCHIVE/FU-P12-T1-6_Uniform_HTML_escaping_in_renderClientWidgets}/FU-P12-T1-6_Validation_Report.md (100%) diff --git a/SPECS/INPROGRESS/FU-P12-T1-6_Uniform_HTML_escaping_in_renderClientWidgets.md b/SPECS/ARCHIVE/FU-P12-T1-6_Uniform_HTML_escaping_in_renderClientWidgets/FU-P12-T1-6_Uniform_HTML_escaping_in_renderClientWidgets.md similarity index 97% rename from SPECS/INPROGRESS/FU-P12-T1-6_Uniform_HTML_escaping_in_renderClientWidgets.md rename to SPECS/ARCHIVE/FU-P12-T1-6_Uniform_HTML_escaping_in_renderClientWidgets/FU-P12-T1-6_Uniform_HTML_escaping_in_renderClientWidgets.md index 65a86e39..f23b1877 100644 --- a/SPECS/INPROGRESS/FU-P12-T1-6_Uniform_HTML_escaping_in_renderClientWidgets.md +++ b/SPECS/ARCHIVE/FU-P12-T1-6_Uniform_HTML_escaping_in_renderClientWidgets/FU-P12-T1-6_Uniform_HTML_escaping_in_renderClientWidgets.md @@ -79,3 +79,7 @@ and audit complexity. 1. Apply uniform escaping in `renderClientWidgets`. 2. Add/update tests for escaped output paths. 3. Run full quality gates and capture results. + +--- +**Archived:** 2026-02-19 +**Verdict:** PASS diff --git a/SPECS/INPROGRESS/FU-P12-T1-6_Validation_Report.md b/SPECS/ARCHIVE/FU-P12-T1-6_Uniform_HTML_escaping_in_renderClientWidgets/FU-P12-T1-6_Validation_Report.md similarity index 100% rename from SPECS/INPROGRESS/FU-P12-T1-6_Validation_Report.md rename to SPECS/ARCHIVE/FU-P12-T1-6_Uniform_HTML_escaping_in_renderClientWidgets/FU-P12-T1-6_Validation_Report.md diff --git a/SPECS/ARCHIVE/INDEX.md b/SPECS/ARCHIVE/INDEX.md index 8d7314f0..2f4504ea 100644 --- a/SPECS/ARCHIVE/INDEX.md +++ b/SPECS/ARCHIVE/INDEX.md @@ -1,6 +1,6 @@ # mcpbridge-wrapper Tasks Archive -**Last Updated:** 2026-02-19 (REVIEW_fu_p12_t1_5_client_identity_retention_archived) +**Last Updated:** 2026-02-19 (FU-P12-T1-6_archived) ## Archived Tasks @@ -120,6 +120,7 @@ | FU-P12-T1-3 | [FU-P12-T1-3_Show_multi-client_widgets_in_Web_UI_instead_of_single_overwritten_active_client/](FU-P12-T1-3_Show_multi-client_widgets_in_Web_UI_instead_of_single_overwritten_active_client/) | 2026-02-18 | PASS | | FU-P12-T1-4 | [FU-P12-T1-4_Make_IN_FLIGHT_KPI_reflect_real_in_flight_requests_in_shared_metrics_mode/](FU-P12-T1-4_Make_IN_FLIGHT_KPI_reflect_real_in_flight_requests_in_shared_metrics_mode/) | 2026-02-19 | PASS | | FU-P12-T1-5 | [FU-P12-T1-5_Cap_clients_dict_and_prune_client_identities_to_prevent_unbounded_growth/](FU-P12-T1-5_Cap_clients_dict_and_prune_client_identities_to_prevent_unbounded_growth/) | 2026-02-19 | PASS | +| FU-P12-T1-6 | [FU-P12-T1-6_Uniform_HTML_escaping_in_renderClientWidgets/](FU-P12-T1-6_Uniform_HTML_escaping_in_renderClientWidgets/) | 2026-02-19 | PASS | | FU-P12-T3-2 | [FU-P12-T3-2_Add_error_code_column_to_audit_CSV_export/](FU-P12-T3-2_Add_error_code_column_to_audit_CSV_export/) | 2026-02-19 | PASS | ## Historical Artifacts @@ -362,5 +363,6 @@ | 2026-02-19 | FU-P12-T1-4 | Archived REVIEW_FU-P12-T1-4_in_flight_shared_metrics report | | 2026-02-19 | FU-P12-T1-5 | Archived Cap_clients_dict_and_prune_client_identities_to_prevent_unbounded_growth (PASS) | | 2026-02-19 | FU-P12-T1-5 | Archived REVIEW_FU-P12-T1-5_client_identity_retention report | +| 2026-02-19 | FU-P12-T1-6 | Archived Uniform_HTML_escaping_in_renderClientWidgets (PASS) | | 2026-02-19 | FU-P12-T3-2 | Archived Add_error_code_column_to_audit_CSV_export (PASS) | | 2026-02-19 | FU-P12-T3-2 | Archived REVIEW_FU-P12-T3-2_error_code_csv_export report | diff --git a/SPECS/INPROGRESS/next.md b/SPECS/INPROGRESS/next.md index 004104aa..0cb0aeac 100644 --- a/SPECS/INPROGRESS/next.md +++ b/SPECS/INPROGRESS/next.md @@ -1,19 +1,16 @@ -# Next Task: FU-P12-T1-6 — Uniform HTML escaping in `renderClientWidgets` +# No Active Task -**Priority:** P3 -**Phase:** Phase 13: Post-Release Follow-ups -**Effort:** 1-2 hours -**Dependencies:** FU-P12-T1-3 -**Status:** Selected +## Recently Archived -## Description +- 2026-02-19 — FU-P12-T1-6: Uniform HTML escaping in `renderClientWidgets` (PASS) +- 2026-02-19 — FU-P12-T1-5: Cap `_clients` dict and prune `client_identities` to prevent unbounded growth (PASS) +- 2026-02-19 — FU-P12-T1-4: Make `IN FLIGHT` KPI reflect real in-flight requests in shared-metrics mode (PASS) +- 2026-02-19 — FU-P12-T3-2: Add `error_code` column to audit CSV export (PASS) +- 2026-02-18 — FU-P12-T1-3: Show multi-client widgets in Web UI instead of single overwritten active client (PASS) +- 2026-02-18 — FU-P12-T1-2: Add code comment clarifying stdin-only client capture in `on_request` (PASS) -In `dashboard.js`, `renderClientWidgets` currently interpolates `count` and -`lastSeen` values directly into `innerHTML` while `name` and `version` are -escaped. Apply `escapeHtml()` uniformly to all interpolated widget values to -keep rendering behavior and security posture consistent. +## Suggested Next Tasks -## Next Step - -Run the PLAN command to create the task PRD with implementation details, -acceptance criteria, and validation gates. +- P13-T5 follow-up — Complete interactive prompt verification in a desktop session (P1) +- FU-P12-T3-1 — Document unused `error_message` parameter in `MetricsCollector.record_response` (P3) +- Final scripted follow-up after this: no additional `pick_next_task` items remain diff --git a/SPECS/Workplan.md b/SPECS/Workplan.md index 2765e1f7..de6357c5 100644 --- a/SPECS/Workplan.md +++ b/SPECS/Workplan.md @@ -2268,7 +2268,8 @@ Phase 9 Follow-up Backlog --- -#### ⬜️ FU-P12-T1-6: Uniform HTML escaping in `renderClientWidgets` +#### ✅ FU-P12-T1-6: Uniform HTML escaping in `renderClientWidgets` +- **Status:** ✅ Completed (2026-02-19) - **Description:** In `dashboard.js` `renderClientWidgets`, the `count` integer and `lastSeen` string are interpolated into innerHTML without `escapeHtml()`, while `name` and `version` are escaped. Although `count` is always a number and `lastSeen` already passes through `escapeHtml` inside `formatRelativeAge`, the asymmetric pattern makes security auditing harder. Apply `escapeHtml()` uniformly to all interpolated values for consistency. - **Priority:** P3 - **Dependencies:** FU-P12-T1-3 @@ -2276,9 +2277,9 @@ Phase 9 Follow-up Backlog - **Outputs/Artifacts:** - Updated `src/mcpbridge_wrapper/webui/static/dashboard.js` — uniform escaping in `renderClientWidgets` - **Acceptance Criteria:** - - [ ] All interpolated values in `renderClientWidgets` are passed through `escapeHtml()` - - [ ] No visual regression in client widget rendering - - [ ] `pytest` suite remains green + - [x] All interpolated values in `renderClientWidgets` are passed through `escapeHtml()` + - [x] No visual regression in client widget rendering + - [x] `pytest` suite remains green --- From 4567a69db13d52a044db0c5042b4bc8b4b7b0675 Mon Sep 17 00:00:00 2001 From: Egor Merkushev Date: Thu, 19 Feb 2026 11:20:10 +0300 Subject: [PATCH 6/8] Review FU-P12-T1-6: uniform client widget escaping --- ...P12-T1-6_uniform_client_widget_escaping.md | 32 +++++++++++++++++++ 1 file changed, 32 insertions(+) create mode 100644 SPECS/INPROGRESS/REVIEW_FU-P12-T1-6_uniform_client_widget_escaping.md diff --git a/SPECS/INPROGRESS/REVIEW_FU-P12-T1-6_uniform_client_widget_escaping.md b/SPECS/INPROGRESS/REVIEW_FU-P12-T1-6_uniform_client_widget_escaping.md new file mode 100644 index 00000000..4c2876f5 --- /dev/null +++ b/SPECS/INPROGRESS/REVIEW_FU-P12-T1-6_uniform_client_widget_escaping.md @@ -0,0 +1,32 @@ +## REVIEW REPORT — FU-P12-T1-6 uniform client widget escaping + +**Scope:** origin/main..HEAD +**Files:** 9 + +### Summary Verdict +- [x] Approve +- [ ] Approve with comments +- [ ] Request changes +- [ ] Block + +### Critical Issues +- None. + +### Secondary Issues +- None. + +### Architectural Notes +- Frontend rendering now escapes all `renderClientWidgets` interpolated values + uniformly, reducing audit ambiguity for future XSS/security reviews. +- Added a static asset assertion in server tests to lock in the escaping path. + +### Tests +- Quality gates rerun and passing: + - `pytest` (`594 passed, 5 skipped, 2 warnings`) + - `ruff check src/` (`All checks passed!`) + - `mypy src/` (`Success: no issues found in 18 source files`) + - `pytest --cov` (`92.18%`, threshold `>=90%`) + +### Next Steps +- No actionable follow-up items identified. +- FOLLOW-UP step can be skipped for this task. From 0449ab06e6ee875aded2c15bdd5e9a61c156acbb Mon Sep 17 00:00:00 2001 From: Egor Merkushev Date: Thu, 19 Feb 2026 11:20:33 +0300 Subject: [PATCH 7/8] Archive REVIEW_FU-P12-T1-6_uniform_client_widget_escaping report --- SPECS/ARCHIVE/INDEX.md | 4 +++- .../REVIEW_FU-P12-T1-6_uniform_client_widget_escaping.md | 0 2 files changed, 3 insertions(+), 1 deletion(-) rename SPECS/{INPROGRESS => ARCHIVE/_Historical}/REVIEW_FU-P12-T1-6_uniform_client_widget_escaping.md (100%) diff --git a/SPECS/ARCHIVE/INDEX.md b/SPECS/ARCHIVE/INDEX.md index 2f4504ea..16afc9bc 100644 --- a/SPECS/ARCHIVE/INDEX.md +++ b/SPECS/ARCHIVE/INDEX.md @@ -1,6 +1,6 @@ # mcpbridge-wrapper Tasks Archive -**Last Updated:** 2026-02-19 (FU-P12-T1-6_archived) +**Last Updated:** 2026-02-19 (REVIEW_fu_p12_t1_6_uniform_client_widget_escaping_archived) ## Archived Tasks @@ -205,6 +205,7 @@ | [REVIEW_FU-P12-T1-3_multi_client_widgets.md](_Historical/REVIEW_FU-P12-T1-3_multi_client_widgets.md) | Review report for FU-P12-T1-3 | | [REVIEW_FU-P12-T1-4_in_flight_shared_metrics.md](_Historical/REVIEW_FU-P12-T1-4_in_flight_shared_metrics.md) | Review report for FU-P12-T1-4 | | [REVIEW_FU-P12-T1-5_client_identity_retention.md](_Historical/REVIEW_FU-P12-T1-5_client_identity_retention.md) | Review report for FU-P12-T1-5 | +| [REVIEW_FU-P12-T1-6_uniform_client_widget_escaping.md](_Historical/REVIEW_FU-P12-T1-6_uniform_client_widget_escaping.md) | Review report for FU-P12-T1-6 | | [REVIEW_FU-P12-T3-2_error_code_csv_export.md](_Historical/REVIEW_FU-P12-T3-2_error_code_csv_export.md) | Review report for FU-P12-T3-2 | ## Archive Log @@ -364,5 +365,6 @@ | 2026-02-19 | FU-P12-T1-5 | Archived Cap_clients_dict_and_prune_client_identities_to_prevent_unbounded_growth (PASS) | | 2026-02-19 | FU-P12-T1-5 | Archived REVIEW_FU-P12-T1-5_client_identity_retention report | | 2026-02-19 | FU-P12-T1-6 | Archived Uniform_HTML_escaping_in_renderClientWidgets (PASS) | +| 2026-02-19 | FU-P12-T1-6 | Archived REVIEW_FU-P12-T1-6_uniform_client_widget_escaping report | | 2026-02-19 | FU-P12-T3-2 | Archived Add_error_code_column_to_audit_CSV_export (PASS) | | 2026-02-19 | FU-P12-T3-2 | Archived REVIEW_FU-P12-T3-2_error_code_csv_export report | diff --git a/SPECS/INPROGRESS/REVIEW_FU-P12-T1-6_uniform_client_widget_escaping.md b/SPECS/ARCHIVE/_Historical/REVIEW_FU-P12-T1-6_uniform_client_widget_escaping.md similarity index 100% rename from SPECS/INPROGRESS/REVIEW_FU-P12-T1-6_uniform_client_widget_escaping.md rename to SPECS/ARCHIVE/_Historical/REVIEW_FU-P12-T1-6_uniform_client_widget_escaping.md From 1630618af9669c800bad86061b14d7762451c4ff Mon Sep 17 00:00:00 2001 From: Egor Merkushev Date: Thu, 19 Feb 2026 11:22:46 +0300 Subject: [PATCH 8/8] Implement FU-P12-T1-6: apply ruff formatting for server static-asset test --- tests/unit/webui/test_server.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/unit/webui/test_server.py b/tests/unit/webui/test_server.py index 0fa51796..c4e30e32 100644 --- a/tests/unit/webui/test_server.py +++ b/tests/unit/webui/test_server.py @@ -163,8 +163,8 @@ def test_dashboard_js_uses_uniform_client_widget_escaping(self, client): """Client widget interpolations in dashboard.js use escapeHtml uniformly.""" response = client.get("/static/dashboard.js") assert response.status_code == 200 - assert "Initialize calls: \" + escapedCount + \"" in response.text - assert "Last seen: \" + escapedLastSeen + \"" in response.text + assert 'Initialize calls: " + escapedCount + "' in response.text + assert 'Last seen: " + escapedLastSeen + "' in response.text assert "var escapedCount = escapeHtml(String(count));" in response.text assert "var escapedLastSeen = escapeHtml(String(lastSeen));" in response.text