mateaix 83660893a6 fix(chat): restrict generated-file link regex to http(s)/relative URLs ... Follow-up to #447. The generated-file link extraction accepted any non-')' text before the path, so a paren-free javascript:/data: URL embedding /api/v1/files/generated/<id> could be captured and bound to an <a href>, enabling XSS on click. Adopt the scheme-restricted pattern already used by SegmentSupersedeDetector and the channel adapters, on both backend (ChatController) and frontend (useChat). Also replace the inline fully-qualified Pattern/Matcher with imports and drop an unused run-overview i18n key. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>		2026-06-28 16:25:11 +08:00
..
src	fix(chat): restrict generated-file link regex to http(s)/relative URLs	2026-06-28 16:25:11 +08:00
Dockerfile	fix(docker): honor SPRING_PROFILES_ACTIVE instead of pinning the mysql profile	2026-06-14 16:47:16 +08:00
pom.xml	fix(db): make KingbaseES driver opt-in and restore default SSRF guard	2026-06-14 10:34:35 +08:00
settings.xml	build(maven): declare US + CN repositories in pom.xml, drop opaque mirror	2026-04-25 09:56:17 +08:00