Rogeeandrogee a2e4f9a1e8 HH-540: scope iframe policy to Widget page (#123) ...

* fix(HH-540): scope iframe policy to widget page

* fix(HH-540): reject non-string allowed domains

---------

Co-authored-by: Rogee <rogee@ipao.vip>

2026-08-23 18:37:08 +08:00

..

coverage3_test.go

H-337: fix Web Channel availability and realtime delivery (#60)

2026-08-20 14:30:05 +08:00

coverage3b_test.go

H-337: fix Web Channel availability and realtime delivery (#60)

2026-08-20 14:30:05 +08:00

coverage4_test.go

H-337: fix Web Channel availability and realtime delivery (#60)

2026-08-20 14:30:05 +08:00

coverage5_test.go

H-300: wire Captain Skills into Web runtime (#48)

2026-08-19 07:08:14 +08:00

coverage6_test.go

test: improve backend unit coverage

2026-08-04 12:26:25 +08:00

widget_handler_test.go

HH-540: scope iframe policy to Widget page (#123)

2026-08-23 18:37:08 +08:00

widget_handler.go

HH-540: scope iframe policy to Widget page (#123)

2026-08-23 18:37:08 +08:00

widget_theme_handler_test.go

HH-438: close upload and remote URL attack surfaces (#89)

2026-08-21 20:36:52 +08:00

widget_theme_handler.go

fix(security): harden auth and secret handling (HH-444) (#101)

2026-08-22 15:45:06 +08:00