fix(liveuamap): preserve safe marker and wrapper semantics

backend/tests/test_liveuamap_parser.py

@@ -44,6 +44,19 @@ def test_common_wrapper_shape():
     assert _ids(payload) == ["wrapped"]
 
 
+def test_coordinate_marker_wins_over_wrapper_named_field():
+    payload = {
+        "id": "direct",
+        "lat": 10,
+        "lng": 20,
+        "data": {"diagnostic": "metadata, not a marker wrapper"},
+    }
+    markers = normalize_liveuamap_payload(payload)
+    assert len(markers) == 1
+    assert markers[0]["id"] == "direct"
+    assert markers[0]["lat"] == 10
+
+
 def test_legacy_urlencoded_base64_json():
     raw = json.dumps([{"id": "legacy", "lat": 1, "lng": 2}]).encode()
     payload = quote(base64.b64encode(raw).decode())

backend/tests/test_liveuamap_provider.py

@@ -73,6 +73,17 @@ def test_api_query_token_is_not_exposed_as_marker_fallback(monkeypatch):
     assert "super-secret" not in repr(markers)
 
 
+def test_non_http_marker_link_is_rejected():
+    markers = scraper._format_markers(
+        [{"id": "evt", "lat": 10, "lng": 20, "link": "javascript:alert(1)"}],
+        region="Ukraine",
+        base_url="https://liveuamap.com",
+        provider="browser",
+    )
+    assert markers[0]["link"] == "https://liveuamap.com"
+    assert "javascript:" not in repr(markers)
+
+
 def test_api_redirect_is_refused_before_following_credentials(monkeypatch):
     monkeypatch.setenv("LIVEUAMAP_API_URL", "https://api.example.test/events")
     monkeypatch.setattr(