mirror of https://github.com/garrytan/gstack.git
461a6e6b18
Was `div.innerHTML = \`<span>\${label}</span>...\`` with label coming
from an event field. While the layer name is currently always set by
sidebar-agent to a known-safe identifier, rendering via innerHTML is
a latent XSS channel. Switch to document.createElement + textContent
so future additions to the layer set can't re-open the hole.
Caught by pre-landing review.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|---|---|---|
| .. | ||
| icons | ||
| background.js | ||
| content.css | ||
| content.js | ||
| inspector.css | ||
| inspector.js | ||
| manifest.json | ||
| popup.html | ||
| popup.js | ||
| sidepanel.css | ||
| sidepanel.html | ||
| sidepanel.js | ||