safishamsiandClaude Opus 4.8 86d8aadd3b fix(export): complete the vis-network crash fix and pin the tooltip XSS boundary (#3699, #3686 follow-ups) ...

#3699: the Fermat-spiral seed positions referenced `i` inside RAW_NODES.map(n => ...)
which has no index param, so the emitted JS threw 'ReferenceError: i is not defined'
and graph.html failed to render at every graph size. Bind the index: map((n, i) => ...).

#3686: the tooltip `title` sinks were correctly un-escaped (vis-network renders a
string title via Popup.setText -> innerText, verified in the pinned 9.1.6 bundle:
its only non-Element branch is innerText and it has zero innerHTML=<var> sinks).
Documented that invariant at the sink as the #1838 stored-XSS boundary.

Adds two guards to test_export.py: a vis-network version pin assertion (a bump must
force re-verifying the innerText tooltip path) and a spiral-seed indexed-map guard
(catches the free-`i` regression, which the substring-only export tests missed).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-09-20 18:07:23 +01:00

..

__init__.py

…

base.py

…

graphdb.py

…

html.py

fix(export): complete the vis-network crash fix and pin the tooltip XSS boundary (#3699, #3686 follow-ups)

2026-09-20 18:07:23 +01:00