Marcel 817835fd6a fix(document): add rel=noopener noreferrer to viewer download link (CWE-1022) ...

The error-state download link opened with target="_blank" but no rel,
exposing the opener to reverse tabnavbabbing. Add rel="noopener
noreferrer". Same-origin so low severity, but a one-token fix in a file
this issue already touches.

Refs #708

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-01 21:12:23 +02:00

..

__meta__

test(meta): add duplicate-id vi.mock detector under __meta__/

2026-05-13 08:06:14 +02:00

lib

fix(document): add rel=noopener noreferrer to viewer download link (CWE-1022)

2026-06-01 21:12:23 +02:00

routes

test(stammbaum): assert AC8 recentre via viewBox, not replaceState (#703)

2026-05-31 19:44:19 +02:00

app.d.ts

feat(observability): add App.Error interface with errorId to app.d.ts

2026-05-17 09:40:12 +02:00

app.html

feat(nav): add ThemeToggle component with moon/sun icons and no-flash script

2026-03-25 13:47:56 +01:00

hooks.client.test.ts

test(observability): add hooks.client.test.ts unit tests for handleError callback

2026-05-17 10:25:30 +02:00

hooks.client.ts

refactor(observability): lower trace sample rate, add DSN comment, improve status visibility

2026-05-17 10:27:01 +02:00

hooks.server.test.ts

test(auth): userGroup hook redirect + cookie cleanup coverage

2026-05-17 22:50:41 +02:00

hooks.server.ts

fix(auth): tighten API URL match, add Retry-After header, and add missing tests

2026-05-19 09:23:01 +02:00

hooks.ts

restructure: flatten workspace nesting, move devcontainer to root

2026-03-15 11:47:58 +01:00

test-setup.ts

test(setup): also disable data-sveltekit-preload-code in browser tests

2026-05-12 22:32:03 +02:00