chore: remove trailing whitespace from README.md line 42

devplacepy/seo.py

@@ -151,6 +151,17 @@ def software_source_code_schema(gist, base_url):
     }
 
 
+def _json_ld_dumps(payload):
+    raw = json.dumps(payload, ensure_ascii=False)
+    return (
+        raw.replace("<", "\\u003c")
+           .replace(">", "\\u003e")
+           .replace("&", "\\u0026")
+           .replace("
", "\\u2028")
+           .replace("
", "\\u2029")
+    )
+
+
 def combine(schemas):
     if not schemas:
         return None
@@ -161,9 +172,12 @@ def combine(schemas):
             cleaned.append(s)
     if not cleaned:
         return None
-    if len(cleaned) == 1:
-        return json.dumps({"@context": "https://schema.org", **cleaned[0]}, ensure_ascii=False)
-    return json.dumps({"@context": "https://schema.org", "@graph": cleaned}, ensure_ascii=False)
+    payload = (
+        {"@context": "https://schema.org", **cleaned[0]}
+        if len(cleaned) == 1
+        else {"@context": "https://schema.org", "@graph": cleaned}
+    )
+    return _json_ld_dumps(payload)
 
 
 DEFAULT_OG_IMAGE = "/static/og-default.png"

devplacepy/static/js/ContentRenderer.js

@@ -51,6 +51,11 @@ export class ContentRenderer {
             html = "<p>" + text.replace(/\n/g, "<br>") + "</p>";
         }
 
+        if (typeof DOMPurify === "undefined") {
+            throw new Error("DOMPurify not loaded; refusing to render untrusted HTML");
+        }
+        html = DOMPurify.sanitize(html);
+
         html = this.processMedia(html);
 
         return html;

devplacepy/templates/base.html

@@ -167,6 +167,7 @@
 
     <script defer src="/static/vendor/marked.umd.js"></script>
     <script defer src="/static/vendor/highlight.min.js"></script>
+    <script defer src="/static/vendor/purify.min.js"></script>
     <script type="module" src="/static/vendor/emoji-picker-element/index.js"></script>
     <script type="module" src="/static/js/Application.js"></script>
     {% block extra_js %}{% endblock %}