Task ID: ff90b5cf-54bf-45f6-a31d-36ad5bc87135
Priority: P50
Type: one_shot
Status: Complete
Improve /hypothesis Mol* dynamic fallback by JS-safe gene literal handling and URL encoding for manual RCSB/AlphaFold search links to keep 3D artifact panel reliable for unusual target gene symbols.
</script> injection attacksBefore:
var gene = {json.dumps(target_gene_first)};After:
var gene = {json.dumps(html.escape(target_gene_first))};Why: Using json.dumps() alone doesn't HTML-escape. If a gene name contains </script>, it could break out of the HTML <script> block and enable XSS. By HTML-escaping before JSON-encoding, </script> becomes \u003c/script\u003e in the JSON string, which prevents the HTML parser from seeing the closing tag sequence.
Tested escaping logic:
TEST</script><script>alert(1)// becomes "TEST</script><script>alert(1)//" — safeFOXP2 becomes "FOXP2" — no changeConfirmed: /showcase page (line 55202+) does NOT include protein_viewer_html or molstar_html. The showcase highlights debate transcripts, hypothesis cards with scores, evidence tables, KG visualizations, and notebooks — not the 3D protein viewer.
json.dumps(target_gene_first) on line 29820 doesn't HTML-escape, allowing </script> injectionjson.dumps(html.escape(target_gene_first))encodeURIComponent(gene) (correct){
"requirements": {
"coding": 8
},
"_reset_note": "This task was reset after a database incident on 2026-04-17.\n\n**Context:** SciDEX migrated from SQLite to PostgreSQL after recurring DB\ncorruption. Some work done during Apr 16-17 may have been lost.\n\n**Before starting work:**\n1. Check if the task's goal is ALREADY satisfied (run the relevant checks)\n2. Check `git log --all --grep=task:YOUR_TASK_ID` for prior commits\n3. If complete, verify and mark done. If partial, continue. If not done, proceed.\n\n**DB change:** SciDEX now uses PostgreSQL. `get_db()` auto-detects via\nSCIDEX_DB_BACKEND=postgres env var.",
"_reset_at": "2026-04-18T06:29:22.046013+00:00",
"_reset_from_status": "done"
}