Échapper les noms de dalles injectés dans l'interface (HTML et <script> inline)

2026-09-18 21:15:26 +02:00
parent 93ac46393f
commit de8d84b94b
2 changed files with 34 additions and 13 deletions
--- a/lidar_pipeline/webapp.py
+++ b/lidar_pipeline/webapp.py
@ -1045,7 +1045,8 @@ def _merge_remote_index():
    try:
        html = html_path.read_text(encoding="utf-8")
        new_html = re.sub(r"const TILES = \[.*?\];",
-                          "const TILES = " + json.dumps(merged, ensure_ascii=False) + ";",
+                          "const TILES = " + json.dumps(merged, ensure_ascii=False)
+                          .replace("</", "<\\/") + ";",
                          html, count=1, flags=re.S)
        if new_html != html:
            html_path.write_text(new_html, encoding="utf-8")