Problem
The verify HTML page interpolates receipt fields raw ({p.query}, {p.answer}) with no html.escape anywhere in the file: a stored query like <script>alert(1)</script> renders as live script.
Where
src/answerproof/api.py (_render_page).
Acceptance
Add a failing test first rendering a page with HTML metachars in query/answer, expecting escaped entities and no raw <script>. Then fix.
Problem
The verify HTML page interpolates receipt fields raw (
{p.query},{p.answer}) with nohtml.escapeanywhere in the file: a stored query like<script>alert(1)</script>renders as live script.Where
src/answerproof/api.py(_render_page).Acceptance
Add a failing test first rendering a page with HTML metachars in query/answer, expecting escaped entities and no raw
<script>. Then fix.