From 632b86639b963656e73af8e959a75968633dcece Mon Sep 17 00:00:00 2001
From: Jamie Holding <cube@themeparks.wiki>
Date: Sun, 1 Nov 2026 14:20:08 +0000
Subject: [PATCH 1/3] fix(migrate): require a per-run token and a known Host,
 and escape quotes in the review page

The migration review server commits entity id changes with the operator's wiki
credential and listens on every interface, but answered anyone: a machine on
the network could pair and commit, and a web page open in the operator's
browser could start a commit with a plain cross-site POST.

- Refuse a request whose Host or Origin does not name this machine, the name
  the tool prints, or MIGRATE_ALLOWED_HOSTS.
- Make a random token for each run. The printed address carries it once; the
  server swaps it for a SameSite=Strict HttpOnly cookie and redirects to a
  clean URL. Every other request needs the cookie.
- The review page built HTML from park and wiki names and ids with an escape
  that left double quotes alone, then used the result inside quoted attributes.
  A name containing a quote could add an event handler, and the page can start
  a commit. Escape quotes, escape the fields that were not escaped at all, and
  move the row and progress templates into functions the tests can call.
- Split startMigrationServer into createMigrationApp (no listen) and the
  listener so the access rules are testable. The default bind is unchanged.
- Share the Host and Origin check with the web admin server.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 src/tools/migrate/__tests__/access.test.ts    | 242 ++++++++++++++++++
 .../migrate/__tests__/uiEscaping.test.ts      | 127 +++++++++
 src/tools/migrate/access.ts                   |  93 +++++++
 src/tools/migrate/index.ts                    |  10 +
 src/tools/migrate/server.ts                   |  31 ++-
 src/tools/migrate/ui/index.html               |  53 ++--
 src/webServerSecurity.ts                      |  36 ++-
 7 files changed, 550 insertions(+), 42 deletions(-)
 create mode 100644 src/tools/migrate/__tests__/access.test.ts
 create mode 100644 src/tools/migrate/__tests__/uiEscaping.test.ts
 create mode 100644 src/tools/migrate/access.ts

diff --git a/src/tools/migrate/__tests__/access.test.ts b/src/tools/migrate/__tests__/access.test.ts
new file mode 100644
index 000000000..cb010aa68
--- /dev/null
+++ b/src/tools/migrate/__tests__/access.test.ts
@@ -0,0 +1,242 @@
+/**
+ * The migration review server can rewrite entity ids with the operator's wiki
+ * credential, and it listens on every interface so it can be reviewed from
+ * another machine. Three things keep strangers out:
+ *
+ *  - a Host and Origin check (DNS rebinding and cross-site posts),
+ *  - a per-run token, handed over once in the printed URL and kept in a
+ *    SameSite=Strict cookie (a direct client on the network),
+ *  - nothing reaches a handler before both.
+ *
+ * The helpers are exercised directly, then the real app is run on loopback
+ * with hand-written Host, Origin and Cookie headers.
+ */
+import http from 'node:http';
+import type {AddressInfo} from 'node:net';
+import {accessUrl, migrateHostnames, newAccessToken} from '../access.js';
+import {createMigrationApp} from '../server.js';
+import type {Mapping} from '../matcher.js';
+
+describe('newAccessToken', () => {
+  test('is long, hex, and different every run', () => {
+    const a = newAccessToken();
+    const b = newAccessToken();
+    expect(a).toMatch(/^[0-9a-f]{48}$/);
+    expect(a).not.toBe(b);
+  });
+});
+
+describe('migrateHostnames', () => {
+  test('loopback, the machine name and MIGRATE_HOST are allowed', () => {
+    const allowed = migrateHostnames({MIGRATE_HOST: 'Review-Box.lan'}, 'My-Machine');
+    for (const name of ['localhost', '127.0.0.1', '::1', 'my-machine', 'review-box.lan']) {
+      expect(allowed.has(name)).toBe(true);
+    }
+  });
+
+  test('a bracketed IPv6 MIGRATE_HOST is stored without brackets', () => {
+    expect(migrateHostnames({MIGRATE_HOST: '[fe80::1]'}, 'box').has('fe80::1')).toBe(true);
+  });
+
+  test('MIGRATE_ALLOWED_HOSTS adds names, trimmed and lowercased', () => {
+    const allowed = migrateHostnames({MIGRATE_ALLOWED_HOSTS: ' 10.0.0.5, Coder.LAN ,'}, 'box');
+    expect(allowed.has('10.0.0.5')).toBe(true);
+    expect(allowed.has('coder.lan')).toBe(true);
+    expect(allowed.has('')).toBe(false);
+  });
+
+  test('an unrelated name is not allowed', () => {
+    expect(migrateHostnames({}, 'box').has('attacker.example')).toBe(false);
+  });
+});
+
+describe('accessUrl', () => {
+  test('carries the token', () => {
+    expect(accessUrl('review-box', 9900, 'abc')).toBe('http://review-box:9900/?token=abc');
+  });
+
+  test('brackets a bare IPv6 host', () => {
+    expect(accessUrl('fe80::1', 9900, 'abc')).toBe('http://[fe80::1]:9900/?token=abc');
+  });
+
+  test('leaves an already bracketed IPv6 host alone', () => {
+    expect(accessUrl('[::1]', 9900, 'abc')).toBe('http://[::1]:9900/?token=abc');
+  });
+});
+
+const MAPPING: Mapping = {
+  wikiId: 'wiki-1',
+  oldExternalId: 'old-1',
+  oldName: 'Old Ride',
+  entityType: 'ATTRACTION',
+  newExternalId: null,
+  newName: null,
+  confidence: 'unmatched',
+  confidenceScore: 0,
+  distance: null,
+  status: 'skip',
+};
+
+describe('createMigrationApp access control', () => {
+  const TOKEN = 'a'.repeat(48);
+  const COOKIE = `migrate_token=${TOKEN}`;
+  let server: http.Server;
+  let port: number;
+  let mappings: Mapping[];
+
+  beforeEach(async () => {
+    mappings = [{...MAPPING}];
+    const app = createMigrationApp(
+      {
+        mappings,
+        unmatchedNew: [],
+        allNewEntities: [],
+        parkName: 'Test Park',
+        // No wiki settings: an authorised POST /api/commit stops at a 400
+        // before any network call, which shows the handler was reached.
+        wikiApiUrl: '',
+        wikiUsername: '',
+        wikiApiKey: '',
+        wikiToken: '',
+        port: 0,
+      },
+      {token: TOKEN, allowed: migrateHostnames({}, 'review-box')},
+    );
+    await new Promise<void>((resolve) => {
+      server = app.listen(0, '127.0.0.1', () => {
+        port = (server.address() as AddressInfo).port;
+        resolve();
+      });
+    });
+  });
+
+  afterEach(() => new Promise<void>((resolve) => server.close(() => resolve())));
+
+  function request(
+    method: string,
+    path: string,
+    headers: Record<string, string> = {},
+    body?: string,
+  ): Promise<{status: number; headers: http.IncomingHttpHeaders; body: string}> {
+    return new Promise((resolve, reject) => {
+      const req = http.request(
+        {host: '127.0.0.1', port, method, path, headers: {Host: `localhost:${port}`, ...headers}},
+        (res) => {
+          let text = '';
+          res.on('data', (chunk) => (text += chunk));
+          res.on('end', () => resolve({status: res.statusCode ?? 0, headers: res.headers, body: text}));
+        },
+      );
+      req.on('error', reject);
+      if (body) req.write(body);
+      req.end();
+    });
+  }
+
+  const json = {'Content-Type': 'application/json'};
+
+  test('no token: the page and the API answer 401', async () => {
+    expect((await request('GET', '/')).status).toBe(401);
+    expect((await request('GET', '/api/mappings')).status).toBe(401);
+    expect((await request('GET', '/api/commit/status')).status).toBe(401);
+  });
+
+  test('no token: a pairing change is refused and does not apply', async () => {
+    const res = await request(
+      'POST',
+      '/api/mappings/0',
+      json,
+      JSON.stringify({action: 'pair', newExternalId: 'attacker-id'}),
+    );
+    expect(res.status).toBe(401);
+    expect(mappings[0].newExternalId).toBeNull();
+  });
+
+  test('no token: the commit never reaches its handler', async () => {
+    const res = await request('POST', '/api/commit');
+    expect(res.status).toBe(401);
+    expect(res.body).not.toContain('WIKI_API_URL');
+  });
+
+  test('a wrong token in the query does not open the door', async () => {
+    const res = await request('GET', `/?token=${'b'.repeat(48)}`);
+    expect(res.status).toBe(401);
+    expect(res.headers['set-cookie']).toBeUndefined();
+  });
+
+  test('a wrong cookie is refused', async () => {
+    const res = await request('GET', '/api/mappings', {Cookie: `migrate_token=${'b'.repeat(48)}`});
+    expect(res.status).toBe(401);
+  });
+
+  test('the 401 explains where to get the token without printing it', async () => {
+    const res = await request('GET', '/');
+    expect(res.body).toContain('?token=');
+    expect(res.body).not.toContain(TOKEN);
+  });
+
+  test('the token in the URL sets a strict HttpOnly cookie and redirects to a clean URL', async () => {
+    const res = await request('GET', `/?token=${TOKEN}`);
+    expect(res.status).toBe(302);
+    expect(res.headers.location).toBe('/');
+    const cookie = String(res.headers['set-cookie']);
+    expect(cookie).toContain(`migrate_token=${TOKEN}`);
+    expect(cookie).toContain('HttpOnly');
+    expect(cookie).toContain('SameSite=Strict');
+  });
+
+  test('the cookie opens the page and the API', async () => {
+    expect((await request('GET', '/', {Cookie: COOKIE})).status).toBe(200);
+    const res = await request('GET', '/api/mappings', {Cookie: COOKIE});
+    expect(res.status).toBe(200);
+    expect(JSON.parse(res.body).parkName).toBe('Test Park');
+  });
+
+  test('with the cookie, a pairing change applies and the commit handler is reached', async () => {
+    const pair = await request(
+      'POST',
+      '/api/mappings/0',
+      {...json, Cookie: COOKIE},
+      JSON.stringify({action: 'pair', newExternalId: 'new-1', newName: 'New Ride'}),
+    );
+    expect(pair.status).toBe(200);
+    expect(mappings[0].newExternalId).toBe('new-1');
+
+    const commit = await request('POST', '/api/commit', {Cookie: COOKIE});
+    expect(commit.status).toBe(400);
+    expect(commit.body).toContain('WIKI_API_URL');
+  });
+
+  test('a foreign Host is refused even with the right cookie (DNS rebinding)', async () => {
+    const res = await request('GET', '/api/mappings', {Host: 'attacker.example:9900', Cookie: COOKIE});
+    expect(res.status).toBe(403);
+  });
+
+  test('a foreign Origin is refused even with the right cookie', async () => {
+    const res = await request('POST', '/api/commit', {
+      Origin: 'https://attacker.example',
+      Cookie: COOKIE,
+    });
+    expect(res.status).toBe(403);
+  });
+
+  test('the machine name the tool prints is accepted as Host', async () => {
+    const res = await request('GET', '/api/mappings', {Host: 'review-box:9900', Cookie: COOKIE});
+    expect(res.status).toBe(200);
+  });
+
+  test('the 403 for a foreign Host says how to allow a name', async () => {
+    const res = await request('GET', '/', {Host: '192.168.1.50:9900'});
+    expect(res.status).toBe(403);
+    expect(res.body).toContain('MIGRATE_ALLOWED_HOSTS');
+  });
+
+  test('the review server sends no CORS headers: the page is same-origin', async () => {
+    const res = await request('GET', '/api/mappings', {
+      Cookie: COOKIE,
+      Origin: `http://localhost:${port}`,
+    });
+    expect(res.status).toBe(200);
+    expect(res.headers['access-control-allow-origin']).toBeUndefined();
+  });
+});
diff --git a/src/tools/migrate/__tests__/uiEscaping.test.ts b/src/tools/migrate/__tests__/uiEscaping.test.ts
new file mode 100644
index 000000000..eb098c738
--- /dev/null
+++ b/src/tools/migrate/__tests__/uiEscaping.test.ts
@@ -0,0 +1,127 @@
+/**
+ * Entity names and ids in the review page come from park APIs and from the
+ * wiki, so they are not trusted. The page is same-origin with the commit
+ * endpoint, so a name that runs script is a way to start a commit.
+ *
+ * The inline script in ui/index.html is loaded into a vm context with just
+ * enough stubs for its top level to run, then the functions that build HTML
+ * are called with hostile values. Nothing here needs a browser: the checks are
+ * on the HTML strings those functions return.
+ */
+import {readFileSync} from 'node:fs';
+import {dirname, join} from 'node:path';
+import {fileURLToPath} from 'node:url';
+import vm from 'node:vm';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const html = readFileSync(join(HERE, '..', 'ui', 'index.html'), 'utf-8');
+const script = /<script>([\s\S]*)<\/script>/.exec(html)![1];
+
+/** Breaks out of a double-quoted attribute and adds an event handler. */
+const ATTRIBUTE_BREAKOUT = '" onfocus="alert(1)" autofocus="';
+const TAG_INJECTION = '<img src=x onerror=alert(1)>';
+
+function loadPage(): vm.Context {
+  const context = vm.createContext({
+    // load() runs at the top level and waits on this forever.
+    fetch: () => new Promise(() => {}),
+    document: {getElementById: () => ({})},
+    console,
+  });
+  vm.runInContext(script, context);
+  return context;
+}
+
+function call(context: vm.Context, source: string): unknown {
+  return vm.runInContext(source, context);
+}
+
+describe('esc', () => {
+  const context = loadPage();
+  const esc = (value: unknown) => {
+    context.input = value;
+    return call(context, 'esc(input)') as string;
+  };
+
+  test('escapes markup and both quote characters', () => {
+    expect(esc(`<a href="x">'&'</a>`)).toBe('&lt;a href=&quot;x&quot;&gt;&#39;&amp;&#39;&lt;/a&gt;');
+  });
+
+  test('null and undefined become empty', () => {
+    expect(esc(null)).toBe('');
+    expect(esc(undefined)).toBe('');
+  });
+
+  test('numbers are written as text', () => {
+    expect(esc(42)).toBe('42');
+  });
+});
+
+describe('renderPairDropdown', () => {
+  test('a hostile id or name cannot leave its attribute', () => {
+    const context = loadPage();
+    context.mapping = {entityType: 'ATTRACTION'};
+    call(
+      context,
+      `data = {
+         mappings: [],
+         allNewEntities: [{newId: ${JSON.stringify(ATTRIBUTE_BREAKOUT)}, name: ${JSON.stringify(
+           ATTRIBUTE_BREAKOUT + TAG_INJECTION,
+         )}, entityType: 'ATTRACTION'}],
+       };`,
+    );
+    const out = call(context, 'renderPairDropdown(0, mapping)') as string;
+
+    const options = [...out.matchAll(/<option ([^>]*)>/g)].slice(1); // first is "Select..."
+    expect(options).toHaveLength(1);
+    // Exactly value="..." and data-name="...": nothing was added.
+    expect((options[0][1].match(/="/g) ?? []).length).toBe(2);
+    expect(out).not.toContain('<img');
+    expect(out).toContain('&quot; onfocus=&quot;');
+  });
+});
+
+describe('renderRowHtml', () => {
+  test('every field from the wiki or the park is escaped', () => {
+    const context = loadPage();
+    context.row = {
+      oldExternalId: TAG_INJECTION,
+      oldName: TAG_INJECTION,
+      entityType: TAG_INJECTION,
+      newExternalId: TAG_INJECTION + TAG_INJECTION,
+      newName: TAG_INJECTION,
+      confidence: 'fuzzy',
+      confidenceScore: 50,
+      distance: null,
+      status: 'confirmed',
+    };
+    call(context, 'data = {mappings: [row], allNewEntities: []};');
+    const out = call(context, 'renderRowHtml(0, row)') as string;
+    expect(out).not.toContain('<img');
+    expect(out).toContain('&lt;img');
+  });
+});
+
+describe('renderProgressLine', () => {
+  test('ids, names and errors are escaped', () => {
+    const context = loadPage();
+    context.event = {
+      success: false,
+      name: TAG_INJECTION,
+      oldId: TAG_INJECTION,
+      newId: TAG_INJECTION,
+      error: TAG_INJECTION,
+    };
+    const out = call(context, 'renderProgressLine(event)') as string;
+    expect(out).not.toContain('<img');
+    expect(out.match(/&lt;img/g)).toHaveLength(4);
+  });
+
+  test('a success line is marked as one', () => {
+    const context = loadPage();
+    context.event = {success: true, name: 'Ride', oldId: 'a', newId: 'b'};
+    const out = call(context, 'renderProgressLine(event)') as string;
+    expect(out).toContain('class="success"');
+    expect(out).toContain('Ride a → b');
+  });
+});
diff --git a/src/tools/migrate/access.ts b/src/tools/migrate/access.ts
new file mode 100644
index 000000000..307bf9f4c
--- /dev/null
+++ b/src/tools/migrate/access.ts
@@ -0,0 +1,93 @@
+/**
+ * Access control for the migration review server.
+ *
+ * The server commits entity id changes with the operator's wiki credential and
+ * listens on every interface, so it can be reviewed from another machine.
+ * Two checks keep everyone else out:
+ *
+ *  - A Host and Origin check, so another website cannot drive it through the
+ *    operator's browser (cross-site posts, DNS rebinding).
+ *  - A random token made for each run. The printed URL carries it once; the
+ *    server answers by setting a SameSite=Strict HttpOnly cookie and
+ *    redirecting to a clean URL, and every later request must carry the
+ *    cookie. A machine on the network that was never given the URL gets a 401.
+ *
+ * Reviewing from a machine whose name is not recognised needs
+ * MIGRATE_ALLOWED_HOSTS (comma separated hostnames, no ports).
+ */
+import {createHash, randomBytes, timingSafeEqual} from 'node:crypto';
+import type {RequestHandler} from 'express';
+import {LOOPBACK_HOSTNAMES, refuseForeignHostOrOrigin} from '../../webServerSecurity.js';
+
+const COOKIE_NAME = 'migrate_token';
+
+export interface Access {
+  token: string;
+  allowed: Set<string>;
+}
+
+export function newAccessToken(): string {
+  return randomBytes(24).toString('hex');
+}
+
+/** Loopback, this machine, MIGRATE_HOST (the name the tool prints) and MIGRATE_ALLOWED_HOSTS. */
+export function migrateHostnames(env: NodeJS.ProcessEnv, machineName: string): Set<string> {
+  const names = [
+    ...LOOPBACK_HOSTNAMES,
+    machineName,
+    (env.MIGRATE_HOST ?? '').replace(/^\[|\]$/g, ''),
+    ...(env.MIGRATE_ALLOWED_HOSTS ?? '').split(','),
+  ];
+  return new Set(names.map((name) => name.trim().toLowerCase()).filter(Boolean));
+}
+
+/** The address to open: the token rides along once and is swapped for a cookie. */
+export function accessUrl(host: string, port: number, token: string): string {
+  const bare = /^\[.+\]$/.test(host);
+  const authority = !bare && host.includes(':') ? `[${host}]` : host;
+  return `http://${authority}:${port}/?token=${token}`;
+}
+
+function sameToken(presented: string | undefined, token: string): boolean {
+  if (!presented) return false;
+  // Hash both so the comparison is constant time whatever the lengths.
+  const a = createHash('sha256').update(presented).digest();
+  const b = createHash('sha256').update(token).digest();
+  return timingSafeEqual(a, b);
+}
+
+function cookieValue(header: string | undefined, name: string): string | undefined {
+  for (const part of (header ?? '').split(';')) {
+    const [key, ...rest] = part.trim().split('=');
+    if (key === name) return rest.join('=');
+  }
+  return undefined;
+}
+
+export function migrateAccessGuard(access: Access): RequestHandler {
+  const refuseForeign = refuseForeignHostOrOrigin(
+    access.allowed,
+    'Forbidden: this host name is not allowed. Set MIGRATE_ALLOWED_HOSTS to add it.',
+  );
+
+  return (req, res, next) =>
+    refuseForeign(req, res, () => {
+      const inUrl = typeof req.query.token === 'string' ? req.query.token : undefined;
+      if (req.method === 'GET' && req.path === '/' && sameToken(inUrl, access.token)) {
+        res.cookie(COOKIE_NAME, access.token, {httpOnly: true, sameSite: 'strict', path: '/'});
+        res.set('Cache-Control', 'no-store');
+        res.redirect(302, '/');
+        return;
+      }
+
+      if (!sameToken(cookieValue(req.headers.cookie, COOKIE_NAME), access.token)) {
+        res
+          .status(401)
+          .type('text/plain')
+          .send('Unauthorised. Open the address printed when the tool started; it ends in ?token=...\n');
+        return;
+      }
+
+      next();
+    });
+}
diff --git a/src/tools/migrate/index.ts b/src/tools/migrate/index.ts
index 087d20148..c10af3445 100644
--- a/src/tools/migrate/index.ts
+++ b/src/tools/migrate/index.ts
@@ -6,6 +6,16 @@
  * Generates old→new entity ID mappings for a park, then serves
  * a browser-based review UI for approving and committing changes
  * to the ThemeParks.wiki API.
+ *
+ * The review server listens on every interface so it can be used from another
+ * machine. Open the address it prints: it carries a token made for that run,
+ * and anything without the token gets a 401. Environment:
+ *
+ *   MIGRATE_PORT           port to listen on (default 9900)
+ *   MIGRATE_HOST           machine name used in the printed address
+ *   MIGRATE_ALLOWED_HOSTS  extra hostnames the browser may use (comma
+ *                          separated, no ports), for opening it by an address
+ *                          other than MIGRATE_HOST or this machine's name
  */
 
 import {getAllDestinations} from '../../destinationRegistry.js';
diff --git a/src/tools/migrate/server.ts b/src/tools/migrate/server.ts
index fa5533452..380ffafbb 100644
--- a/src/tools/migrate/server.ts
+++ b/src/tools/migrate/server.ts
@@ -10,8 +10,9 @@ import {readFileSync} from 'fs';
 import {join} from 'path';
 import os from 'node:os';
 import type {Mapping, NewEntity} from './matcher.js';
+import {accessUrl, migrateAccessGuard, migrateHostnames, newAccessToken, type Access} from './access.js';
 
-interface ServerConfig {
+export interface ServerConfig {
   mappings: Mapping[];
   unmatchedNew: NewEntity[];
   allNewEntities: NewEntity[];
@@ -23,8 +24,13 @@ interface ServerConfig {
   port: number;
 }
 
-export function startMigrationServer(config: ServerConfig): void {
+/**
+ * Builds the review app without listening, so it can be tested. The access
+ * guard is mounted first: no route, the page included, answers without it.
+ */
+export function createMigrationApp(config: ServerConfig, access: Access): express.Express {
   const app = express();
+  app.use(migrateAccessGuard(access));
   app.use(express.json());
 
   // State
@@ -281,18 +287,21 @@ export function startMigrationServer(config: ServerConfig): void {
     }
   }
 
-  // ── Start ────────────────────────────────────────────────────
+  return app;
+}
+
+/** Builds the app and listens on every interface, printing the address to open. */
+export function startMigrationServer(config: ServerConfig): void {
+  const access: Access = {token: newAccessToken(), allowed: migrateHostnames(process.env, os.hostname())};
+  const app = createMigrationApp(config, access);
 
   app.listen(config.port, '0.0.0.0', () => {
-    const rawHost = process.env.MIGRATE_HOST || os.hostname();
-    // Bracket IPv6 literals (`::1`, `fe80::1`) for the printed URL — `http://::1:9900/`
-    // isn't a valid URL, but `http://[::1]:9900/` is.
-    const isBracketedIPv6 = /^\[.+\]$/.test(rawHost);
-    const looksIPv6 = !isBracketedIPv6 && rawHost.includes(':');
-    const host = looksIPv6 ? `[${rawHost}]` : rawHost;
+    const host = process.env.MIGRATE_HOST || os.hostname();
     console.log(`\nMigration review server running on :${config.port} (bound 0.0.0.0)`);
     console.log(`  ${config.parkName}`);
-    console.log(`  ${mappings.length} mappings to review`);
-    console.log(`\nOpen http://${host}:${config.port}/ in your browser to review (or http://localhost:${config.port}/ when running on the same machine).\n`);
+    console.log(`  ${config.mappings.length} mappings to review`);
+    console.log(`\nOpen ${accessUrl(host, config.port, access.token)} in your browser to review.`);
+    console.log(`The link carries a token made for this run; anyone without it gets a 401.`);
+    console.log(`To open it by any other name or address, set MIGRATE_ALLOWED_HOSTS to that name.\n`);
   });
 }
diff --git a/src/tools/migrate/ui/index.html b/src/tools/migrate/ui/index.html
index 33e727df7..938b4654e 100644
--- a/src/tools/migrate/ui/index.html
+++ b/src/tools/migrate/ui/index.html
@@ -182,19 +182,7 @@ <h3 id="progressTitle">Committing...</h3>
     if (m.status === 'skip') rowClasses.push('skip');
     tr.className = rowClasses.join(' ');
 
-    const distStr = m.distance !== null ? `<span class="distance">${m.distance}m</span>` : '';
-    const noopTag = m.noop ? '<span class="tag-noop">No-op</span>' : '';
-
-    tr.innerHTML = `
-      <td class="mono">${esc(m.oldExternalId)}</td>
-      <td>${esc(m.oldName)}${noopTag}</td>
-      <td class="arrow arrow-${m.confidence}">${m.newExternalId ? '→' : '—'}</td>
-      <td class="mono">${m.newExternalId ? esc(m.newExternalId.substring(0, 12) + '...') : renderPairDropdown(idx, m)}</td>
-      <td>${m.newName ? esc(m.newName) : ''} ${distStr}</td>
-      <td style="font-size:11px;color:#888">${m.entityType}</td>
-      <td class="confidence conf-${m.confidence}">${renderConfidence(m)}</td>
-      <td class="actions">${renderActions(idx, m)}</td>
-    `;
+    tr.innerHTML = renderRowHtml(idx, m);
     tbody.appendChild(tr);
   });
 
@@ -204,11 +192,38 @@ <h3 id="progressTitle">Committing...</h3>
   commitBtn.disabled = confirmed === 0;
 }
 
-function esc(s) { const d = document.createElement('div'); d.textContent = s; return d.innerHTML; }
+// Names and ids come from park APIs and the wiki, so none of them is trusted.
+// Quotes are escaped as well because some of this output lands inside
+// double-quoted attributes. Plain string work, so the unit tests can run it
+// without a DOM.
+function esc(s) {
+  return String(s ?? '')
+    .replace(/&/g, '&amp;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#39;');
+}
+
+function renderRowHtml(idx, m) {
+  const distStr = m.distance !== null ? `<span class="distance">${esc(m.distance)}m</span>` : '';
+  const noopTag = m.noop ? '<span class="tag-noop">No-op</span>' : '';
+
+  return `
+      <td class="mono">${esc(m.oldExternalId)}</td>
+      <td>${esc(m.oldName)}${noopTag}</td>
+      <td class="arrow arrow-${esc(m.confidence)}">${m.newExternalId ? '→' : '—'}</td>
+      <td class="mono">${m.newExternalId ? esc(m.newExternalId.substring(0, 12) + '...') : renderPairDropdown(idx, m)}</td>
+      <td>${m.newName ? esc(m.newName) : ''} ${distStr}</td>
+      <td style="font-size:11px;color:#888">${esc(m.entityType)}</td>
+      <td class="confidence conf-${esc(m.confidence)}">${renderConfidence(m)}</td>
+      <td class="actions">${renderActions(idx, m)}</td>
+    `;
+}
 
 function renderConfidence(m) {
   if (m.confidence === 'exact') return '● Exact';
-  if (m.confidence === 'fuzzy') return `● Fuzzy (${m.confidenceScore}%)`;
+  if (m.confidence === 'fuzzy') return `● Fuzzy (${esc(m.confidenceScore)}%)`;
   return '● None';
 }
 
@@ -314,6 +329,11 @@ <h3 id="progressTitle">Committing...</h3>
   document.getElementById('confirmOverlay').classList.remove('active');
 }
 
+function renderProgressLine(d) {
+  const cls = d.success ? 'success' : 'fail';
+  return `<div class="${cls}">${d.success ? '✓' : '✗'} ${esc(d.name)} ${esc(d.oldId)} → ${esc(d.newId)} ${d.error ? '(' + esc(d.error) + ')' : ''}</div>`;
+}
+
 async function doCommit() {
   hideConfirm();
   document.getElementById('progressOverlay').classList.add('active');
@@ -332,8 +352,7 @@ <h3 id="progressTitle">Committing...</h3>
     document.getElementById('progressFill').style.width = pct + '%';
     document.getElementById('progressStatus').textContent = `${d.index}/${d.total}`;
     const log = document.getElementById('progressLog');
-    const cls = d.success ? 'success' : 'fail';
-    log.innerHTML += `<div class="${cls}">${d.success ? '✓' : '✗'} ${esc(d.name || '')} ${d.oldId || ''} → ${d.newId || ''} ${d.error ? '(' + esc(d.error) + ')' : ''}</div>`;
+    log.innerHTML += renderProgressLine(d);
     log.scrollTop = log.scrollHeight;
   });
   evtSource.addEventListener('complete', (e) => {
diff --git a/src/webServerSecurity.ts b/src/webServerSecurity.ts
index 7eca14b91..892b75e9c 100644
--- a/src/webServerSecurity.ts
+++ b/src/webServerSecurity.ts
@@ -19,7 +19,7 @@
 import cors from 'cors';
 import type {RequestHandler, Response} from 'express';
 
-const LOOPBACK_HOSTNAMES = ['localhost', '127.0.0.1', '::1'];
+export const LOOPBACK_HOSTNAMES = ['localhost', '127.0.0.1', '::1'];
 
 /** Where to listen. Loopback by default; WEB_ADMIN_HOST opts in to another interface. */
 export function resolveBindHost(env: NodeJS.ProcessEnv): string {
@@ -52,25 +52,33 @@ export function allowedHostnames(env: NodeJS.ProcessEnv): Set<string> {
   return new Set([...LOOPBACK_HOSTNAMES, ...extra]);
 }
 
-function refuse(res: Response): void {
-  res.status(403).json({error: 'Forbidden'});
-}
-
-/** Refuses foreign Host and Origin headers, then answers CORS for the rest. */
-export function webAdminGuard(env: NodeJS.ProcessEnv): RequestHandler {
-  const allowed = allowedHostnames(env);
-  // Only allowed origins get past the checks below, so reflecting is safe.
-  const answerCors = cors({origin: true});
-
+/**
+ * Refuses (403) a request whose Host header, or Origin header when it has one,
+ * does not name an allowed host. Shared with the migration review server.
+ */
+export function refuseForeignHostOrOrigin(allowed: Set<string>, message = 'Forbidden'): RequestHandler {
   return (req, res, next) => {
     const host = hostnameOf(req.headers.host);
-    if (!host || !allowed.has(host)) return refuse(res);
+    if (!host || !allowed.has(host)) return refuse(res, message);
 
     if (req.headers.origin !== undefined) {
       const origin = hostnameOf(req.headers.origin);
-      if (!origin || !allowed.has(origin)) return refuse(res);
+      if (!origin || !allowed.has(origin)) return refuse(res, message);
     }
 
-    answerCors(req, res, next);
+    next();
   };
 }
+
+function refuse(res: Response, message: string): void {
+  res.status(403).json({error: message});
+}
+
+/** Refuses foreign Host and Origin headers, then answers CORS for the rest. */
+export function webAdminGuard(env: NodeJS.ProcessEnv): RequestHandler {
+  const refuseForeign = refuseForeignHostOrOrigin(allowedHostnames(env));
+  // Only allowed origins get past the check above, so reflecting is safe.
+  const answerCors = cors({origin: true});
+
+  return (req, res, next) => refuseForeign(req, res, () => answerCors(req, res, next));
+}

From 4f25f9ef09c933a64ef06c9fdafe239abb985bfe Mon Sep 17 00:00:00 2001
From: Jamie Holding <cube@themeparks.wiki>
Date: Sun, 1 Nov 2026 14:22:54 +0000
Subject: [PATCH 2/3] fix(web-admin): validate the CORS origin in the policy
 itself

Moving the Host and Origin check into its own function meant the CORS policy
reflected any origin and relied on a check elsewhere. Validate in the origin
callback as well so the policy stands on its own. Also match the script tag
case-insensitively when the escaping test reads the review page.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 src/tools/migrate/__tests__/uiEscaping.test.ts |  2 +-
 src/webServerSecurity.ts                       | 13 ++++++++++---
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/src/tools/migrate/__tests__/uiEscaping.test.ts b/src/tools/migrate/__tests__/uiEscaping.test.ts
index eb098c738..c2a533483 100644
--- a/src/tools/migrate/__tests__/uiEscaping.test.ts
+++ b/src/tools/migrate/__tests__/uiEscaping.test.ts
@@ -15,7 +15,7 @@ import vm from 'node:vm';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 const html = readFileSync(join(HERE, '..', 'ui', 'index.html'), 'utf-8');
-const script = /<script>([\s\S]*)<\/script>/.exec(html)![1];
+const script = /<script[^>]*>([\s\S]*)<\/script\s*>/i.exec(html)![1];
 
 /** Breaks out of a double-quoted attribute and adds an event handler. */
 const ATTRIBUTE_BREAKOUT = '" onfocus="alert(1)" autofocus="';
diff --git a/src/webServerSecurity.ts b/src/webServerSecurity.ts
index 892b75e9c..362e86463 100644
--- a/src/webServerSecurity.ts
+++ b/src/webServerSecurity.ts
@@ -76,9 +76,16 @@ function refuse(res: Response, message: string): void {
 
 /** Refuses foreign Host and Origin headers, then answers CORS for the rest. */
 export function webAdminGuard(env: NodeJS.ProcessEnv): RequestHandler {
-  const refuseForeign = refuseForeignHostOrOrigin(allowedHostnames(env));
-  // Only allowed origins get past the check above, so reflecting is safe.
-  const answerCors = cors({origin: true});
+  const allowed = allowedHostnames(env);
+  const refuseForeign = refuseForeignHostOrOrigin(allowed);
+  // The check above already refuses foreign origins; this repeats it so the
+  // CORS policy never depends on code somewhere else.
+  const answerCors = cors({
+    origin: (origin, callback) => {
+      const name = hostnameOf(origin);
+      callback(null, origin === undefined || (name !== undefined && allowed.has(name)));
+    },
+  });
 
   return (req, res, next) => refuseForeign(req, res, () => answerCors(req, res, next));
 }

From 4e0321392953c296e979ed98df065d3ad41537d9 Mon Sep 17 00:00:00 2001
From: Jamie Holding <cube@themeparks.wiki>
Date: Sun, 1 Nov 2026 14:25:06 +0000
Subject: [PATCH 3/3] test(migrate): slice the inline script by position
 instead of with a regex

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 src/tools/migrate/__tests__/uiEscaping.test.ts | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/tools/migrate/__tests__/uiEscaping.test.ts b/src/tools/migrate/__tests__/uiEscaping.test.ts
index c2a533483..f1a515be2 100644
--- a/src/tools/migrate/__tests__/uiEscaping.test.ts
+++ b/src/tools/migrate/__tests__/uiEscaping.test.ts
@@ -15,7 +15,12 @@ import vm from 'node:vm';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 const html = readFileSync(join(HERE, '..', 'ui', 'index.html'), 'utf-8');
-const script = /<script[^>]*>([\s\S]*)<\/script\s*>/i.exec(html)![1];
+// The page has one inline script and no other <script> text, so slice by position.
+const SCRIPT_OPEN = '<script>';
+const scriptStart = html.indexOf(SCRIPT_OPEN);
+const scriptEnd = html.lastIndexOf('</script>');
+if (scriptStart === -1 || scriptEnd < scriptStart) throw new Error('ui/index.html has no inline script');
+const script = html.slice(scriptStart + SCRIPT_OPEN.length, scriptEnd);
 
 /** Breaks out of a double-quoted attribute and adds an event handler. */
 const ATTRIBUTE_BREAKOUT = '" onfocus="alert(1)" autofocus="';