mirror of https://github.com/garrytan/gstack.git
4179390799
DOM text-node serialization escapes & < > but NOT " or '. Call sites that interpolate escapeHtml output inside attribute values (title="...", data-x="...") were vulnerable to attribute-injection: an attacker- influenced CSS property value (rule.selector, prop.value from the inspector) or agent status field landing in one of those attributes could break out with " onload=alert(1). Add explicit quote escaping in escapeHtml + keep existing callers working (no breakage — output is strictly more escaped, not less). Caught by claude adversarial subagent. The earlier banner-layer fix was the same class of bug but on a different code path. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| icons | ||
| background.js | ||
| content.css | ||
| content.js | ||
| inspector.css | ||
| inspector.js | ||
| manifest.json | ||
| popup.html | ||
| popup.js | ||
| sidepanel.css | ||
| sidepanel.html | ||
| sidepanel.js | ||