/api/setname accepts any string up to 14 chars with no character filtering, and it flows into card_svg.render() and into /card.svg, which is served as image/svg+xml. If card_svg.py interpolates the name without escaping, a name containing markup would be injected into the rendered SVG. Check whether escaping happens; if not, add it, and add a test covering a name with <, > and &.
Files: card_svg.py, app.py, tests/
/api/setname accepts any string up to 14 chars with no character filtering, and it flows into card_svg.render() and into /card.svg, which is served as image/svg+xml. If card_svg.py interpolates the name without escaping, a name containing markup would be injected into the rendered SVG. Check whether escaping happens; if not, add it, and add a test covering a name with <, > and &.
Files: card_svg.py, app.py, tests/