Ho Ngoc Hai 585fdc6ab6 fix(web): XSS in Mapbox popup, add CSP header, CSRF on media upload ...

- Replace innerHTML/setHTML with DOM API (createElement/textContent/setDOMContent)
  to prevent XSS via user-controlled listing titles, URLs, and prices
- Add Content-Security-Policy header to next.config.js with proper directives
  for Mapbox, API, images, workers, and frame-ancestors
- Add X-CSRF-Token header to media upload fetch call, matching apiClient behavior

Co-Authored-By: Paperclip <noreply@paperclip.ing>

2026-04-08 13:08:10 +07:00

..

api

fix(api): add JWT scheme to @ApiBearerAuth and fix Prisma 7 extensions config

2026-04-08 13:08:03 +07:00

web

fix(web): XSS in Mapbox popup, add CSP header, CSRF on media upload

2026-04-08 13:08:10 +07:00