corex-ui / corex / 1de608ce78ff49b9d21763f9d7edde38bf67354c

93%

push

github

Harden redirect allowlists and fix security contributor docs (#135)

* docs: security policy, contributing accuracy, e2e showcase

Point vulnerability reports at GitHub Security Advisories, document
trusted HTML sinks, MCP, and the LiveView 1.1 pin versus the upstream
CVE floor. Fix CONTRIBUTING drift and state that e2e is a published
showcase, not a starter.

Co-authored-by: Karim Semmoud <karim-semmoud@users.noreply.github.com>

* fix: reject NUL, CR, and LF in redirect allowlists

After stripping leading C0/space, destinations that still contain NUL
or newlines cannot pass Corex.Url or the JS redirect helper, including
mailto header-injection patterns.

Co-authored-by: Karim Semmoud <karim-semmoud@users.noreply.github.com>

* chore: typescript dep, Hexdocs DataList group, e2e Dependabot

Add typescript as a direct devDependency so tsc resolves under pnpm,
list Corex.DataList once in Hexdocs, and watch e2e Mix deps.

Co-authored-by: Karim Semmoud <karim-semmoud@users.noreply.github.com>

* docs: avoid Hexdocs warnings in the unreleased changelog

Do not link Corex.Url as a module or SECURITY.md as a Hex extra.

Co-authored-by: Karim Semmoud <karim-semmoud@users.noreply.github.com>

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Karim Semmoud <karim-semmoud@users.noreply.github.com>

7 of 7 new or added lines in 1 file covered. (100.0%)

8222 of 8819 relevant lines covered (93.23%)

36.61 hits per line