null/BillTracker
null
/
BillTracker
1
0
Fork 0
Code Issues 4 Pull Requests Packages Projects Releases 1 Wiki Activity
BillTracker/services
History
null c31d8cbe9e fix(qa): escape bill name in reminder email HTML — XSS via bill name (B14-04) 
- notificationService buildEmailHtml: the message line interpolated bill.name
  raw (`<strong>${bill.name}</strong> is due…`) while the detail table escaped
  it; a `<img src=x onerror=…>` name landed unescaped in the email HTML. Now
  escaped everywhere. (self-XSS — reminders go to the bill's owner — but a clear
  inconsistent-escaping defect)
- expose buildEmailHtml via _email; add an escaping test across all 4 email types
- docs: archive QA-B14-04

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 		2026-07-02 22:18:05 -05:00
..
advisoryFilterService.js feat: advisory non-bill transaction filter system (batch 0.33.8.0) 2026-05-29 18:06:12 -05:00
amountSuggestionService.js feat(money): cents migration stage 2 — schema flip to integer cents (batch 0.38.4) 2026-06-11 20:12:31 -05:00
analyticsService.js fix(qa): Analytics "expected" gates by occurrence (matches Tracker/Summary) 2026-07-02 21:23:37 -05:00
aprService.js chore(qa): vendor chunk splitting, remove unused markdown deps, remove dead totalInterestPaid (batch 0.41.0 QA cleanup) 2026-07-02 20:47:50 -05:00
auditService.js v0.20.6: Audit logging for critical operations 2026-05-10 00:03:12 -05:00
authService.js feat(server): add trust proxy, CSRF HTTPS detection, error formatting, dates util (batch 0.38.0) 2026-06-10 19:37:19 -05:00
backupScheduler.js feat(roadmap): size grid from populated lanes + db cleanup fixes 2026-05-30 13:04:27 -05:00
backupService.js feat: Payoff Custom mode, Summary reordering, unifed billing schedule, SimpleFIN + backup fixes (batch v0.34.1.3) 2026-05-30 21:20:51 -05:00
bankSyncConfigService.js fix(bank-sync): admin config, matching, and worker updates 2026-06-07 19:41:17 -05:00
bankSyncService.js feat(banking): bank transactions page with merchant/store matching, transaction matching refactor, bank sync improvements (batch 0.40.0) 2026-06-14 15:15:31 -05:00
bankSyncWorker.js fix(bank-sync): transaction matching, services, and worker updates 2026-06-07 20:07:27 -05:00
billMerchantRuleService.js feat(money): cents migration stage 2 — schema flip to integer cents (batch 0.38.4) 2026-06-11 20:12:31 -05:00
billsService.js fix(qa): seed demo data amounts, bill amount validation, negative USD format, a11y aria-labels, Playwright E2E setup (batch 0.41.0 QA) 2026-07-02 20:36:09 -05:00
calendarFeedService.js feat(money): cents migration stage 2 — schema flip to integer cents (batch 0.38.4) 2026-06-11 20:12:31 -05:00
cleanupService.js fix(match-suggestions): use rejection timestamps and share late attribution helper 2026-06-06 14:06:28 -05:00
csvTransactionImportService.js v0.28.01 2026-05-16 20:26:09 -05:00
driftService.js feat(money): cents migration stage 2 — schema flip to integer cents (batch 0.38.4) 2026-06-11 20:12:31 -05:00
encryptionService.js feat(encryption): support TOKEN_ENCRYPTION_KEY env var with startup migration 2026-06-06 15:27:45 -05:00
loginFingerprint.js v0.28.0 2026-05-15 22:45:38 -05:00
matchSuggestionService.js feat(money): cents migration stage 2 — schema flip to integer cents (batch 0.38.4) 2026-06-11 20:12:31 -05:00
merchantStoreMatchService.js feat(banking): bank transactions page with merchant/store matching, transaction matching refactor, bank sync improvements (batch 0.40.0) 2026-06-14 15:15:31 -05:00
notificationService.js fix(qa): escape bill name in reminder email HTML — XSS via bill name (B14-04) 2026-07-02 22:18:05 -05:00
oidcService.js fix(auth): oidc service updates 2026-06-07 18:05:09 -05:00
paymentAccountingService.js feat(money): cents migration stage 2 — schema flip to integer cents (batch 0.38.4) 2026-06-11 20:12:31 -05:00
paymentValidation.js feat(money): cents migration stage 2 — schema flip to integer cents (batch 0.38.4) 2026-06-11 20:12:31 -05:00
simplefinService.js feat(auth): add per-username rate limiter, migrate dates to local-time utils (batch 0.38.1) 2026-06-10 19:42:51 -05:00
snowballService.js feat(money): migrate services to cent-exact money.js helpers (batch 0.38.3) 2026-06-10 20:14:13 -05:00
spendingService.js feat(spending): category groups, YNAB-style spending page overhaul, 3-month averages, cover overspending (batch 0.41.0) 2026-06-14 19:21:34 -05:00
spreadsheetImportService.js feat(money): cents migration stage 2 — schema flip to integer cents (batch 0.38.4) 2026-06-11 20:12:31 -05:00
statusRuntime.js perf: worker N+1 batching, status runtime DB persistence, 'use strict' 2026-06-04 21:32:28 -05:00
statusService.js feat(money): cents migration stage 2 — schema flip to integer cents (batch 0.38.4) 2026-06-11 20:12:31 -05:00
subscriptionService.js feat(money): cents migration stage 2 — schema flip to integer cents (batch 0.38.4) 2026-06-11 20:12:31 -05:00
totpService.js refactor: otplib named imports, cleanup totpService internal naming 2026-06-04 04:16:20 -05:00
trackerService.js feat(cashflow): safe-to-spend projection with timeline, vitest setup, package upgrades 2026-06-12 01:32:28 -05:00
transactionMatchService.js feat(money): cents migration stage 2 — schema flip to integer cents (batch 0.38.4) 2026-06-11 20:12:31 -05:00
transactionService.js fix(bank-sync): transaction matching, services, and worker updates 2026-06-07 20:07:27 -05:00
updateCheckService.js v0.27.02 push 2026-05-14 21:00:07 -05:00
userDbImportService.js feat(money): cents migration stage 2 — schema flip to integer cents (batch 0.38.4) 2026-06-11 20:12:31 -05:00
userSettings.js feat(spending): category groups, YNAB-style spending page overhaul, 3-month averages, cover overspending (batch 0.41.0) 2026-06-14 19:21:34 -05:00
webauthnService.js security: WebAuthn / FIDO2 hardware security key 2FA 2026-06-05 22:05:23 -05:00