chore: lint (esc() XSS-guard on homepage feed), v0.1.0 → v0.2.0 (session close)

f94ea17061eba4edb136d5eb280d834945cd3dcf · 2026-07-20 12:10:49 -0700 · Steve
Files touched

M package-lock.json
M package.json
M public/index.html
Diff

commit f94ea17061eba4edb136d5eb280d834945cd3dcf
Author: Steve <steve@designerwallcoverings.com>
Date:   Mon Jul 20 12:10:49 2026 -0700

    chore: lint (esc() XSS-guard on homepage feed), v0.1.0 → v0.2.0 (session close)
---
 package-lock.json |  4 ++--
 package.json      |  4 +---
 public/index.html | 10 +++++-----
 3 files changed, 8 insertions(+), 10 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 7c49c33b..488d5a60 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "rentv-v1",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "rentv-v1",
-      "version": "0.1.0",
+      "version": "0.2.0",
       "dependencies": {
         "express": "^4.21.2"
       }
diff --git a/package.json b/package.json
index 439ce6e2..0ee71bcb 100644
--- a/package.json
+++ b/package.json
@@ -1,3 +1 @@
-{ "name": "rentv-v1", "version": "0.1.0", "private": true, "main": "server.js",
-  "scripts": { "start": "node server.js", "pull": "node scripts/pull-news.mjs" },
-  "dependencies": { "express": "^4.21.2" } }
+{"name":"rentv-v1","version":"0.2.0","private":true,"main":"server.js","scripts":{"start":"node server.js","pull":"node scripts/pull-news.mjs"},"dependencies":{"express":"^4.21.2"}}
\ No newline at end of file
diff --git a/public/index.html b/public/index.html
index 21e03259..b8c21044 100644
--- a/public/index.html
+++ b/public/index.html
@@ -117,15 +117,15 @@
 <script>
 document.getElementById('today').textContent = new Date().toLocaleDateString(undefined,{weekday:'long',year:'numeric',month:'long',day:'numeric'});
 let ALL=[], cat='all';
-const catImg=c=>c;
+const esc=s=>(s||'').replace(/[&<>"]/g,c=>({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;'}[c]));
 function render(){
   const items = cat==='all'?ALL:ALL.filter(x=>x.cat===cat);
   const lead=items[0];
-  if(lead){document.getElementById('lead').innerHTML='<a href="'+lead.url+'" target="_blank" rel="noopener"><div class="img"></div><span class="chip">'+lead.cat+' · Western U.S.</span><h1>'+lead.title+'</h1><div class="byl">By RENTV Staff · live from rentv.com</div></a>';}
-  const cards=items.slice(1,13).map(x=>'<a class="card" href="'+x.url+'" target="_blank" rel="noopener"><div class="img"></div><span class="chip">'+x.cat+'</span><h4>'+x.title+'</h4><div class="byl">RENTV Staff</div></a>').join('');
+  if(lead){document.getElementById('lead').innerHTML='<a href="'+esc(lead.url)+'" target="_blank" rel="noopener"><div class="img"></div><span class="chip">'+esc(lead.cat)+' · Western U.S.</span><h1>'+esc(lead.title)+'</h1><div class="byl">By RENTV Staff · live from rentv.com</div></a>';}
+  const cards=items.slice(1,13).map(x=>'<a class="card" href="'+esc(x.url)+'" target="_blank" rel="noopener"><div class="img"></div><span class="chip">'+esc(x.cat)+'</span><h4>'+esc(x.title)+'</h4><div class="byl">RENTV Staff</div></a>').join('');
   document.getElementById('cards').innerHTML=cards||'<p style="color:var(--sub)">No items in this section right now.</p>';
-  document.getElementById('breaking').innerHTML=ALL.slice(0,6).map(x=>'<span>'+x.title+'</span>').join(' · ').repeat(2);
-  document.getElementById('mostread').innerHTML=ALL.slice(0,5).map(x=>'<li><a href="'+x.url+'" target="_blank" rel="noopener">'+x.title+'</a></li>').join('');
+  document.getElementById('breaking').innerHTML=ALL.slice(0,6).map(x=>'<span>'+esc(x.title)+'</span>').join(' · ').repeat(2);
+  document.getElementById('mostread').innerHTML=ALL.slice(0,5).map(x=>'<li><a href="'+esc(x.url)+'" target="_blank" rel="noopener">'+esc(x.title)+'</a></li>').join('');
 }
 async function load(){
   try{
← f3c51020 Fold The REview (rentvreview.com) into rentv-v1 as native vi · back to Rentv 2026 · auto-save: 2026-07-20T12:32:08 (1 files) — data/news.json 683810fd →