second pass. medium

bincio/edit/server.py

@@ -265,11 +265,15 @@ async function uploadFiles(files) {
   }
 }
 
+function escapeHtml(s) {
+  return s.replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;').replace(/'/g,'&#39;');
+}
+
 function renderImageList() {
   const list = document.getElementById('image-list');
   list.innerHTML = uploadedImages.map(f =>
-    `<span class="image-chip">${f}
-      <button type="button" onclick="removeImage('${f}')" title="Remove">×</button>
+    `<span class="image-chip">${escapeHtml(f)}
+      <button type="button" onclick="removeImage('${escapeHtml(f)}')" title="Remove">×</button>
     </span>`
   ).join('');
 }
@@ -405,7 +409,7 @@ async def save_activity(activity_id: str, payload: dict[str, Any]) -> JSONRespon
     lines: list[str] = []
     if payload.get("title"):
         lines.append(f"title: {json.dumps(payload['title'])}")
-    if payload.get("sport") and payload["sport"] != "other":
+    if payload.get("sport") and payload["sport"] in SPORTS and payload["sport"] != "other":
         lines.append(f"sport: {payload['sport']}")
     if payload.get("gear"):
         lines.append(f"gear: {json.dumps(payload['gear'])}")
@@ -443,7 +447,12 @@ async def upload_image(activity_id: str, file: UploadFile = File(...)) -> JSONRe
 
     images_dir = dd / "edits" / "images" / activity_id
     images_dir.mkdir(parents=True, exist_ok=True)
-    dest = images_dir / Path(file.filename).name
+    safe_name = Path(file.filename).name
+    # Only allow image content types
+    ct = file.content_type or ""
+    if not ct.startswith("image/"):
+        raise HTTPException(400, f"Only image files are accepted (got {ct})")
+    dest = images_dir / safe_name
     dest.write_bytes(await file.read())
     return JSONResponse({"ok": True, "filename": dest.name})
 

bincio/extract/config.py

@@ -58,7 +58,7 @@ class ExtractConfig:
 
 
 def load_config(path: Path) -> ExtractConfig:
-    raw = yaml.safe_load(path.read_text())
+    raw = yaml.safe_load(path.read_text()) or {}
 
     inp = raw.get("input", {})
     dirs = [Path(d).expanduser() for d in inp.get("dirs", [])]

bincio/render/merge.py

@@ -155,9 +155,10 @@ def merge_all(data_dir: Path) -> int:
                 edits = {}
         else:
             edits = {}
+        _ATHLETE_EDITABLE = {"max_hr", "ftp_w", "hr_zones", "power_zones", "seasons", "gear"}
         if edits:
             athlete_data = json.loads(athlete_src.read_text(encoding="utf-8"))
-            athlete_data.update(edits)
+            athlete_data.update({k: v for k, v in edits.items() if k in _ATHLETE_EDITABLE})
             athlete_dest.write_text(json.dumps(athlete_data, indent=2, ensure_ascii=False))
         else:
             athlete_dest.symlink_to(athlete_src.resolve())