safishamsi 98c7ec039a fix(export): close stored XSS + broken neighbor links in graph.html (#1838) ...

The HTML report's neighbor "focus" links dropped an unescaped
JSON.stringify(nid) into a double-quoted inline onclick. The stringified
value carries its own quotes, so the attribute was truncated on every
node (links never worked), and a node id/label containing a double-quote
broke out of the attribute and injected live event handlers. AST ids are
[a-z0-9_]-safe, but ids/labels from documents or titles scraped via
`graphify add <url>` are not, so a hostile source could plant an
executable handler into a locally-opened report.

Carry the id in an HTML-escaped data-nid attribute and dispatch via one
delegated listener bound to document (survives the innerHTML rebuild that
recreates #neighbors-list). Closes the injection and repairs the links.

Reported by @edgestack-ai.

Co-Authored-By: edgestack-ai <edgestack-ai@users.noreply.github.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-13 17:48:26 +01:00

..

fixtures

fix(extract): scope Pascal/Delphi call resolution + resolve inherited calls across files (#1739)

2026-07-09 00:32:21 +01:00

__init__.py

…

bench_extract.py

…

conftest.py

…

test_affected_cli.py

fix: resolve explain/affected when a source-file path matches multiple nodes (#1503)

2026-06-27 23:57:39 +01:00

test_affected_member_seed.py

feat(ruby/affected): mixes_in edges for include/extend/prepend + method-bound callers in affected (#1668, #1669)

2026-07-05 11:41:18 +01:00

test_agents_platform.py

feat(install): add cross-framework agents platform (+ skills alias)

2026-06-23 17:26:49 +01:00

test_analyze.py

fix(analyze): exclude rationale nodes from suggested-question gap count (#1768)

2026-07-11 11:52:12 +01:00

test_anthropic_custom_endpoint.py

…

test_antigravity_install.py

…

test_astro_extraction.py

…

test_backend_extras.py

…

test_benchmark.py

…

test_build_merge_hyperedges_and_prune.py

fix(build): never prune a re-extracted source in build_merge (#1796)

2026-07-11 17:22:25 +01:00

test_build.py

fix(build): merge markdown quick-scan doc node into its semantic _doc twin (#1799)

2026-07-12 10:23:36 +01:00

test_builtin_global_type_refs.py

test(extract): cover builtin static-call shape (Date.now()) for #1726

2026-07-08 12:09:40 +01:00

test_cache.py

fix(cache): scope semantic cache writes to extracted files (#1757)

2026-07-13 00:35:32 +01:00

test_callflow_html.py

…

test_cargo_introspect.py

…

test_case_sensitive_resolution.py

fix(extract): case-sensitive cross-file resolution in case-sensitive languages (#1581)

2026-07-01 15:09:42 +01:00

test_charmap_encoding.py

…

test_chunking.py

fix(cache): scope the incremental checkpoint write too (#1757 followup)

2026-07-13 00:47:10 +01:00

test_claude_cli_backend.py

fix(claude-cli): deliver extraction instructions in the user turn

2026-07-02 22:29:30 +01:00

test_claude_md.py

fix(uninstall): remove graphify hook/section from Claude local-only files (#1731)

2026-07-08 16:38:35 +01:00

test_cli_broken_pipe.py

fix(export): coerce non-scalar attrs in graphml; harden pipe-close flush

2026-07-12 23:57:16 +01:00

test_cli_export.py

test(cli): graph.json node ids are portable across checkout paths (#1789)

2026-07-11 16:31:10 +01:00

test_cluster.py

…

test_codebuddy.py

…

test_community_hub_labels.py

fix(cluster): detect stale community labels on cluster-only re-cluster

2026-07-01 11:52:50 +01:00

test_confidence.py

…

test_corrupt_graph_json.py

test(build): add regression tests for corrupt graph.json (#1537)

2026-07-01 10:49:43 +01:00

test_cpp_objc_cross_file_calls.py

feat(extract): cross-file member-call resolution for C++ and ObjC (#1547, #1556)

2026-06-30 18:30:05 +01:00

test_cpp_preprocess.py

…

test_cross_language_call_resolution.py

fix(extract): never bind a cross-file call to a definition in another language family

2026-07-08 01:16:58 +01:00

test_csharp_member_calls.py

test(csharp): chained call off new X(...) resolves (#1770)

2026-07-10 21:57:16 +01:00

test_csharp_type_resolution.py

feat(csharp): namespace-aware cross-file type resolution (#1562)

2026-06-30 19:32:10 +01:00

test_dart.py

…

test_dedup.py

fix(dedup): warn on cross-chunk node ID collision to surface silent data loss (#1504)

2026-07-01 10:47:10 +01:00

test_detect.py

fix(detect,hooks): honor .git/info/exclude; guard worktrees (#1810, #1809)

2026-07-12 16:15:24 +01:00

test_devin.py

…

test_dotnet.py

fix(sln): keep Visual Studio solution-folder node ids relative (#1789)

2026-07-12 14:31:50 +01:00

test_explain_cli.py

feat(reflect): work-memory overlay — surface learned verdicts as a graph sidecar (#1441)

2026-06-30 11:19:54 +01:00

test_export.py

fix(export): close stored XSS + broken neighbor links in graph.html (#1838)

2026-07-13 17:48:26 +01:00

test_extract_cache_location.py

fix(cache): stat-index must follow the cache location, not the key anchor

2026-07-13 10:29:26 +01:00

test_extract_cli.py

fix(cache): scope semantic cache writes to extracted files (#1757)

2026-07-13 00:35:32 +01:00

test_extract_code_only_cli.py

feat(extract): add --code-only to index code without an LLM key on a mixed repo (#1734)

2026-07-08 17:07:31 +01:00

test_extract.py

fix(extract): write AST cache to CWD, decoupled from the key anchor (#1774)

2026-07-13 01:34:35 +01:00

test_extraction_spec_ids.py

fix(ids): node IDs include the full repo-relative path (#1504, #1509)

2026-06-28 16:57:00 +01:00

test_extractors_registry.py

test(extractors): guard facade + registry identity for the per-language split (#1721)

2026-07-09 13:22:36 +01:00

test_falkordb_integration.py

…

test_file_node_id_spec.py

fix(ids): node IDs include the full repo-relative path (#1504, #1509)

2026-06-28 16:57:00 +01:00

test_file_slice.py

…

test_gemini_hook.py

Fix: port the Gemini CLI BeforeTool graph-nudge hook to be shell-agnostic too (#522)

2026-07-06 16:43:21 +01:00

test_global_graph.py

…

test_google_workspace.py

…

test_hook_guard.py

test: rigorous edge cases for the hook-guard subcommand (#522)

2026-07-06 16:49:31 +01:00

test_hooks.py

fix(detect,hooks): honor .git/info/exclude; guard worktrees (#1810, #1809)

2026-07-12 16:15:24 +01:00

test_hypergraph.py

fix(hyperedge): accept members/node_ids alias keys for the member list (#1561)

2026-06-30 16:58:23 +01:00

test_id_normalization_contract.py

…

test_image_vision.py

Contain symlinked extraction inputs

2026-07-02 22:29:32 +01:00

test_import_extension_resolution.py

…

test_incremental.py

fix(update): prune edges owned by a re-extracted file (#1521)

2026-06-28 19:29:51 +01:00

test_indirect_dispatch_assign_return.py

feat(extract): capture assignment/return indirect_call edges (#1566 slice 2)

2026-06-30 23:26:13 +01:00

test_indirect_dispatch_getattr.py

feat(extract): capture getattr(obj, "name") indirect_call edges (#1566 slice 3)

2026-07-01 10:30:47 +01:00

test_indirect_dispatch.py

fix(extract): cross-file indirect_call survives id relativization (0.9.4 regression)

2026-07-01 11:43:05 +01:00

test_ingest.py

feat: self-improving work-memory — save-result outcomes + graphify reflect (#1441)

2026-06-24 11:43:13 +01:00

test_install_references.py

…

test_install_roundtrip.py

…

test_install_strings.py

Fix: port the Gemini CLI BeforeTool graph-nudge hook to be shell-agnostic too (#522)

2026-07-06 16:43:21 +01:00

test_install_upgrade.py

Fix: make Claude Code / Codebuddy PreToolUse graph-nudge hooks work on Windows (#522)

2026-07-06 16:38:42 +01:00

test_install.py

Fix: make Claude Code / Codebuddy PreToolUse graph-nudge hooks work on Windows (#522)

2026-07-06 16:38:42 +01:00

test_java_member_calls.py

fix(extract): resolve Java member calls by receiver type (#1696)

2026-07-10 02:11:36 +01:00

test_java_type_resolution.py

fix(extract): resolve Java cross-module type references by import (#1744)

2026-07-09 10:44:50 +01:00

test_js_import_resolution.py

fix(extract): don't report deferred import() as a file cycle (#1241)

2026-07-05 10:42:09 +01:00

test_label_retry.py

…

test_labeling.py

Fix: salvage truncated labeling replies and account for labeling token cost (#1690, #1694)

2026-07-06 12:46:12 +01:00

test_language_resolvers.py

feat(ruby): type-aware member-call resolution via a resolver framework (#1499)

2026-06-29 09:40:22 +01:00

test_languages.py

fix(extract): emit Kotlin enum entries as nodes with case_of edges (#1700 Kotlin half, #1738)

2026-07-08 22:49:01 +01:00

test_llm_backends.py

Feat: opt-in GRAPHIFY_DISABLE_THINKING; correct deepseek thinking default (#1621)

2026-07-06 16:02:45 +01:00

test_llm_parser.py

fix(claude-cli): deliver extraction instructions in the user turn

2026-07-02 22:29:30 +01:00

test_long_path_hashing.py

fix(detect): incremental correctness for Office sources + long paths, cache word counts (#1649, #1655, #1656)

2026-07-04 22:12:47 +01:00

test_manifest_ingest.py

…

test_mcp_ingest.py

…

test_merge_graphs_cli.py

fix(merge-graphs): give each input a distinct repo tag so same-stem nodes don't collapse (#1729)

2026-07-08 12:45:08 +01:00

test_minhash.py

…

test_multigraph_compat.py

…

test_multigraph_diagnostics.py

…

test_multilang.py

fix(rust): emit field type references for tuple structs

2026-07-01 13:45:53 +01:00

test_obsidian_dangling_member.py

fix(export): guard to_canvas against dangling community members (#1236 follow-up)

2026-07-03 18:34:41 +01:00

test_obsidian_filename_cap.py

…

test_office_incremental.py

fix(detect): incremental correctness for Office sources + long paths, cache word counts (#1649, #1655, #1656)

2026-07-04 22:12:47 +01:00

test_office_limits.py

…

test_ollama_retry_cap.py

Fix: cap Ollama client-side retries so a hung request cannot multiply the stall (#1686)

2026-07-06 12:44:47 +01:00

test_ollama.py

…

test_openai_custom_endpoint.py

…

test_pascal_call_scoping.py

fix(extract): scope Pascal/Delphi call resolution + resolve inherited calls across files (#1739)

2026-07-09 00:32:21 +01:00

test_pascal_resolution.py

fix(extract): scope Pascal/Delphi call resolution + resolve inherited calls across files (#1739)

2026-07-09 00:32:21 +01:00

test_pascal.py

fix: surface silently-skipped dirs in enumeration + dedup Pascal edges

2026-07-09 01:06:02 +01:00

test_path_cli.py

fix(path): prefer full-token label matches when resolving path endpoints (#1785)

2026-07-11 11:56:38 +01:00

test_paths.py

fix(resolve): test mocks no longer erase the real cross-file call graph (#1553)

2026-06-30 16:59:16 +01:00

test_pg_introspect.py

fix(pg_introspect): read FKs from pg_constraint so read-only roles get references edges (#1746)

2026-07-10 11:12:28 +01:00

test_phantom_cross_package_call.py

fix(extract): gate JS/TS cross-file calls on import evidence to kill phantom cross-package edges (#1659)

2026-07-04 21:22:39 +01:00

test_phantom_external_import.py

fix: harden semantic extraction and kill phantom import edges (#1631, #1638, #1632)

2026-07-04 03:12:23 +01:00

test_pipeline.py

…

test_provider_registry.py

…

test_prs.py

…

test_python_import_resolution.py

…

test_query_cli.py

…

test_querylog.py

fix(querylog): make the query log opt-in, off by default (#1797)

2026-07-12 10:36:00 +01:00

test_rationale.py

feat: extract rationale comments + ADR/RFC doc references from JS/TS

2026-07-06 00:45:51 +01:00

test_read_hook.py

Fix: make Claude Code / Codebuddy PreToolUse graph-nudge hooks work on Windows (#522)

2026-07-06 16:38:42 +01:00

test_reflect.py

fix(reflect): layout-ordered source resolution for overlay staleness (#1558)

2026-06-30 12:57:33 +01:00

test_replace_or_append_section.py

Fix: exact-match section heading in _replace_or_append_section to prevent CLAUDE.md data loss (#1688)

2026-07-06 12:36:12 +01:00

test_report.py

fix(report): don't emit dangling [[_COMMUNITY_*]] wikilinks by default (#1712)

2026-07-07 10:57:52 +01:00

test_ruby_resolution.py

fix(extract): route .rake files to the Ruby extractor + resolution (#1784)

2026-07-11 11:31:47 +01:00

test_scip_ingest.py

…

test_search_hook.py

Fix: make Claude Code / Codebuddy PreToolUse graph-nudge hooks work on Windows (#522)

2026-07-06 16:38:42 +01:00

test_security.py

test: guard to_html/sanitize_label against null source_file/label (#1775)

2026-07-10 20:24:25 +01:00

test_semantic_cleanup.py

fix(hyperedge): accept members/node_ids alias keys for the member list (#1561)

2026-06-30 16:58:23 +01:00

test_semantic_fragment_sanitize.py

fix: harden semantic extraction and kill phantom import edges (#1631, #1638, #1632)

2026-07-04 03:12:23 +01:00

test_semantic_id_remap_root.py

fix(build): don't crash when a node's source_file is the scan root (#1618)

2026-07-03 00:32:24 +01:00

test_semantic_similarity.py

…

test_serve_http.py

feat(serve): optional project_path for multi-project MCP serving

2026-07-02 12:11:51 +01:00

test_serve.py

fix(query): dedup seeds by label to stop generic-symbol flooding (#1766)

2026-07-13 01:03:02 +01:00

test_skill_version_warning.py

fix(cli): make skill-version warning direction-aware (#1568)

2026-06-30 23:15:52 +01:00

test_skillgen.py

fix(cache): scope semantic cache writes to extracted files (#1757)

2026-07-13 00:35:32 +01:00

test_swift_cross_file_calls.py

fix(swift): resolve calls on a singleton cached into a local var (#1604)

2026-07-02 11:46:22 +01:00

test_swift_import_resolution.py

…

test_symbol_resolution.py

fix(resolve): test mocks no longer erase the real cross-file call graph (#1553)

2026-06-30 16:59:16 +01:00

test_terraform.py

…

test_transcribe.py

…

test_ts_decorators.py

fix(extract): emit reference edges for TS/JS decorators

2026-07-02 22:38:29 +01:00

test_ts_generators.py

fix(extract): extract TS/JS generator functions as nodes

2026-07-02 22:38:28 +01:00

test_ts_import_require.py

fix: harden semantic extraction and kill phantom import edges (#1631, #1638, #1632)

2026-07-04 03:12:23 +01:00

test_ts_inheritance.py

…

test_ts_namespace.py

fix(extract): emit a node for TS namespace / module containers

2026-07-02 22:38:29 +01:00

test_ts_receiver_member_calls.py

feat(extract): TS/JS member calls on local new-binding + typed-param receivers (#1630)

2026-07-03 16:03:18 +01:00

test_typescript_module_extensions.py

Treat .mts/.cts (TypeScript module extensions) as TypeScript

2026-07-02 22:29:31 +01:00

test_validate.py

Fix: validate_extraction crashes on non-hashable node id / edge endpoint

2026-06-24 08:54:11 +01:00

test_vue_extraction.py

fix(extract): parse .vue SFC <script> with the right grammar (#1468)

2026-06-26 10:20:53 +01:00

test_watch.py

fix(watch): require deletion evidence before evicting a missing source (#1795)

2026-07-12 00:37:09 +01:00

test_wheel_packaging.py

feat(install): add cross-framework agents platform (+ skills alias)

2026-06-23 17:26:49 +01:00

test_wiki.py

fix(wiki): portable relative markdown links so navigation works outside Obsidian (#1444)

2026-06-27 10:19:15 +01:00

test_word_count_cache.py

fix(detect): incremental correctness for Office sources + long paths, cache word counts (#1649, #1655, #1656)

2026-07-04 22:12:47 +01:00

test_zero_node_no_cache.py

fix(extract): don't cache zero-node results; warn on empty source files (#1666)

2026-07-05 10:33:07 +01:00