Fix ADS-B sidebar deselect bug, ACARS XSS, and classifier dead code

- Clear sidebar highlights and ACARS message timer when stale selected
  aircraft is removed in cleanupOldAircraft()
- Escape all user-controlled strings in renderAcarsCard(),
  addAcarsMessage(), and renderAcarsMainCard() before innerHTML insertion
- Remove dead duplicate H1 check in classify_message_type
- Move _d label from link_test set to handshake return path

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
mitchross
2026-02-26 18:34:35 -05:00
parent 66f582f087
commit f652011366
4 changed files with 34 additions and 26 deletions
+2 -2
View File
@@ -127,7 +127,7 @@ def classify_message_type(label: str | None, text: str | None = None) -> str:
# Position reports
if label in ('H1', '20', '15', '16', '30', 'S1'):
return 'position'
if label == 'H1' or (text and '#M1BPOS' in text):
if text and '#M1BPOS' in text:
return 'position'
# Engine / DFDR data
@@ -155,7 +155,7 @@ def classify_message_type(label: str | None, text: str | None = None) -> str:
return 'squawk'
# Link test / handshake
if label in ('_d', 'Q0', 'QA', 'QB', 'QC', 'QD', 'QE', 'QF', 'QG',
if label in ('Q0', 'QA', 'QB', 'QC', 'QD', 'QE', 'QF', 'QG',
'QH', 'QK', 'QM', 'QN', 'QP', 'QQ', 'QR', 'QS', 'QT', 'QX',
'4X'):
return 'link_test'