fix(html-view): require the resolved file of a mint to be HTML

The mint checked the extension of the requested path, then built the page
URL from the symlink-resolved file name. A `report.html -> notes.txt` link
minted a page URL for the text file. The resolved name now has to be
.html or .htm as well, the mint-side counterpart of the serving route's
resolved-path extension check.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Codeman maintainer committed 2026-10-13 17:10:39 +02:00
1 parent 432faf7254
commit bc940a3953
2 files changed
+9

No files matched your search

+3
View File
@@ -78,6 +78,9 @@ describe('html-view routes', () => {
it('refuses non-HTML files and missing files', async () => {
expect((await open(join(workspace, 'data.json'))).statusCode).toBe(400);
expect((await open(join(workspace, 'missing.html'))).statusCode).toBe(404);
// An .html name that links to something else is judged by its target.
symlinkSync(join(workspace, 'data.json'), join(workspace, 'data.html'));
expect((await open(join(workspace, 'data.html'))).statusCode).toBe(400);
});
it('serves the page sandboxed, never same-origin', async () => {