penpot/frontend
Andrey Antukh 67d9567971
🐛 Prevent CSS injection vulnerability in font family names
Add a shared `schema:font-family` whitelist validator in
app.common.types.font that only allows letters, digits, spaces,
hyphens, underscores, and dots in font family names. Apply the schema
to create-font-variant and update-font RPC endpoints on the
backend, and add client-side validation in the dashboard fonts UI.
Include unit tests for the schema and integration tests for the RPC
handlers.

Signed-off-by: Andrey Antukh <niwi@niwi.nz>
2026-05-14 13:46:02 +02:00
..
2024-12-23 10:03:10 +01:00
2026-01-22 13:55:41 +01:00
2026-04-28 10:21:56 +02:00
2026-03-26 14:12:11 +01:00
2025-12-23 13:10:58 +01:00
2026-05-13 14:14:10 +02:00
2026-05-13 14:14:10 +02:00
2026-02-10 08:29:24 +01:00
2025-11-05 17:15:19 +01:00