Elie Habib f7119b9ed6 Harden CORS, XSS, and input validation across all API endpoints and components ...

- Add CORS origin allowlist (api/_cors.js) replacing Access-Control-Allow-Origin: *
- Add isDisallowedOrigin guard to all API endpoints (acled, cloudflare-outages, finnhub, fred-data, hackernews, wingbits)
- Gut debug-env endpoint to return 404
- Tighten sanitizeUrl() with escapeAttr output and strict relative URL validation
- Add sanitizeUrl() adoption in CountryIntelModal, InsightsPanel, PredictionPanel, RegulationPanel, TechEventsPanel
- Comprehensive escapeHtml() hardening in MapPopup (cables, flights, vessels, clusters)
- Bound HackerNews concurrent fetches (MAX_CONCURRENCY=10), validate story type and limit params
- Add wingbits cache eviction (MAX_LOCAL_CACHE_ENTRIES=2000, sweep on TTL + LRU)
- Fix arxiv http→https, og-story parseInt safety with Number.isFinite + clamping

2026-02-11 14:35:07 +04:00

..

details

Harden CORS, XSS, and input validation across all API endpoints and components

2026-02-11 14:35:07 +04:00

[[...path]].js

Harden CORS, XSS, and input validation across all API endpoints and components

2026-02-11 14:35:07 +04:00