An audit of every place the web pages and the query service's renderers turn record data into HTML or SVG found nothing exploitable, so this adds tests that pin that behaviour. Every field a stranger can write reaches markup through an escape helper: a scrobble's text, emoji and model, handles, display names, repo URLs and operator names. That covers /lanes, /burn, the cards and avatars on the web side, and card.rs, share.rs, swarm.rs, badge.rs, zine.rs and tour.rs on the server side. The escape helpers cover ", every attribute is double-quoted, and links taken from records must be https. The remaining innerHTML uses are constant markup or dev pages that are not served.
The tests send hostile values through the rendering paths: tag and handler injection, a quote-breaking handle, a right-to-left override, and a javascript: repo URL. They assert that each comes out as text, and that no link is made from a bad URL. web/dev/test/lanes.test.mjs covers /lanes, burn.test.mjs covers /burn and the burn card, and card.rs covers the server-drawn card. The web suite passes apart from the two known failures, the shells test and the placeholder guard, and so does the query crate.
🤖 Generated with Claude Code