mirror of
https://github.com/basecamp/once-campfire.git
synced 2026-08-28 17:42:50 +09:00
Jeremy Daer
2fd1483e16
Add a headless-browser system test that stores a </style><script> payload in custom_styles, loads a page, and asserts the payload arrives as an external text/css stylesheet and never executes (no script breakout, no window flag set). It fails against the old inline rendering. Bust the stylesheet cache key with the repo's millisecond :epoch format so two saves within the same second still produce distinct URLs — the five-minute public cache would otherwise pin the first save.