From 491fae3d520dc7f47ee8c445cbcfd41628b7ad32 Mon Sep 17 00:00:00 2001 From: Javier Munarriz Date: Sat, 29 Aug 2026 19:58:38 +0200 Subject: [PATCH 1/5] LeanFin: HTML-escape user-controlled strings (stored XSS) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit LeanFin interpolated account names, label names and bank-supplied transaction text straight into `format!` HTML templates. A name containing markup executed script on five surfaces: - /leanfin/accounts manual account name (element body) - /leanfin/settings app_id (value="" attribute) - /leanfin account/label