q792602257andClaude Opus 4.6
8381b3068a
Tests / Test failed: 4, passed: 744
Replace hand-written f-string + html.escape() rendering in the Host Agent
local console with a module-level Jinja2 Environment configured with
select_autoescape(["html","xml"]). XSS safety now holds by mechanism
rather than per-call discipline — every operator-controlled field
(device name, connection_info, task summary, etc.) is escaped by the
engine uniformly.
Eight templates under host_agent/web/templates/ replace the former
_chrome(), _CSS, escape(), and per-page _xxx_body() helpers: base.html
(header/nav/CSS + {% block body %}), login, dashboard (with the polling
<script> preserved byte-identically inside {% raw %}), devices, account,
history, tasks_list, and task_detail. The task-list and task-detail
templates — added by the just-landed task-execution-progress-visibility
change — were also migrated here rather than left in f-string form,
since this change removes the shared helpers they depended on.
URLs, auth/session/CSRF semantics, redirects, and /api/status JSON are
unchanged. 15 new template tests cover render-smoke, XSS probing, script
byte-identity, and no-autoescape-bypass guards. Tasks 8.1-8.6 (manual
browser verification) remain.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
32 lines
744 B
TOML
32 lines
744 B
TOML
[project]
|
|
name = "device-host-agent"
|
|
version = "0.1.0"
|
|
description = "Outbound device-host worker for the Device Cloud Platform."
|
|
requires-python = ">=3.14"
|
|
dependencies = [
|
|
"device-agent-runtime==0.1.0",
|
|
"device-cloud-platform==0.1.0",
|
|
"fastapi>=0.115.0",
|
|
"httpx>=0.27.0",
|
|
"jinja2>=3.1",
|
|
"uvicorn[standard]>=0.30.0",
|
|
]
|
|
|
|
[project.scripts]
|
|
device-host-agent = "host_agent.cli:main"
|
|
|
|
[build-system]
|
|
requires = ["setuptools>=69"]
|
|
build-backend = "setuptools.build_meta"
|
|
|
|
[tool.setuptools.packages.find]
|
|
where = ["."]
|
|
include = ["host_agent*"]
|
|
|
|
[tool.setuptools.package-data]
|
|
"host_agent.web" = ["templates/*.html"]
|
|
|
|
[tool.uv.sources]
|
|
device-agent-runtime = { workspace = true }
|
|
device-cloud-platform = { workspace = true }
|