Skip to content

Fix multiple bugs: XSS vulnerabilities, operator precedence, event listener loss, race condition #2180

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
hobostay wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Fix multiple bugs: XSS vulnerabilities, operator precedence, event listener loss, race condition #2180

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion ts/packages/agents/video/src/videoActionHandler.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -198,7 +198,7 @@ function createVideoPlaceHolder(
container.innerText = "❌ Failed to retrieve video content.";
}
} else {
container.innerHTML = "<div>❌ Video generation failed: " + statusData.failure_reason ?? "" + "</div>";
container.innerHTML = "<div>❌ Video generation failed: " + (statusData.failure_reason ?? "") + "</div>";
console.log(JSON.stringify(statusData, null, 2));
}
}
Expand Down
45 changes: 41 additions & 4 deletions ts/packages/shell/src/main/browserViewManager.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -196,8 +196,20 @@ export class BrowserViewManager {
// only show the error if it's for the page the user was asking
// it's possible some other resource failed to load (image, script, etc.)
if (validatedURL === options.url) {
const safeUrl = options.url
Copy link
Copy Markdown
Collaborator

@robgruen robgruen Apr 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since this is pattern is repeated for safeErr, can we make this a utility method somewhere and call it.

.replace(/&/g, "&amp;")
.replace(/</g, "&lt;")
.replace(/>/g, "&gt;")
.replace(/"/g, "&quot;")
.replace(/'/g, "&#39;");
const safeDesc = errorDesc
.replace(/&/g, "&amp;")
.replace(/</g, "&lt;")
.replace(/>/g, "&gt;")
.replace(/"/g, "&quot;")
.replace(/'/g, "&#39;");
webContentsView.webContents.executeJavaScript(
`document.body.innerHTML = "There was an error loading '${options.url}'.<br />Error Details: <br />${errorCode} - ${errorDesc}"`,
`document.body.innerHTML = "There was an error loading '${safeUrl}'.<br />Error Details: <br />${errorCode} - ${safeDesc}"`,
);
}
},
Expand Down Expand Up @@ -261,9 +273,21 @@ export class BrowserViewManager {
`Error loading URL ${webContentsView.webContents.getURL()} in tab ${tabId}:`,
err,
);

const safeUrl = webContentsView.webContents
.getURL()
.replace(/&/g, "&amp;")
.replace(/</g, "&lt;")
.replace(/>/g, "&gt;")
.replace(/"/g, "&quot;")
.replace(/'/g, "&#39;");
const safeErr = String(err)
.replace(/&/g, "&amp;")
.replace(/</g, "&lt;")
.replace(/>/g, "&gt;")
.replace(/"/g, "&quot;")
.replace(/'/g, "&#39;");
webContentsView.webContents.executeJavaScript(
`document.body.innerHTML = "There was an error loading '${webContentsView.webContents.getURL()}'.<br />: ${err}"`,
`document.body.innerHTML = "There was an error loading '${safeUrl}'.<br />: ${safeErr}"`,
);
});
} else {
Expand All @@ -274,8 +298,21 @@ export class BrowserViewManager {
`Error loading URL ${webContentsView.webContents.getURL()} in tab ${tabId}:`,
err,
);
const safeUrl = webContentsView.webContents
.getURL()
.replace(/&/g, "&amp;")
.replace(/</g, "&lt;")
.replace(/>/g, "&gt;")
.replace(/"/g, "&quot;")
.replace(/'/g, "&#39;");
const safeErr = String(err)
.replace(/&/g, "&amp;")
.replace(/</g, "&lt;")
.replace(/>/g, "&gt;")
.replace(/"/g, "&quot;")
.replace(/'/g, "&#39;");
webContentsView.webContents.executeJavaScript(
`document.body.innerHTML = "There was an error loading '${webContentsView.webContents.getURL()}'.<br />: ${err}"`,
`document.body.innerHTML = "There was an error loading '${safeUrl}'.<br />: ${safeErr}"`,
);
});
}
Expand Down
6 changes: 5 additions & 1 deletion ts/packages/shell/src/renderer/src/setContent.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -294,12 +294,16 @@ export function setContent(
${css}
</head>
<body style="height: auto; overflow: hidden; background: transparent;">${message}</body></html>`;
}).catch((err) => {
console.error(`Failed to load CSS for iframe: ${err}`);
iframe.srcdoc = `<html>
<body style="height: auto; overflow: hidden; background: transparent;">${message}</body></html>`;
});

contentElm.appendChild(iframe);
} else {
// vanilla, sanitized HTML only
contentElm.innerHTML += contentHtml;
contentElm.insertAdjacentHTML("beforeend", contentHtml);

// Add click handlers for all links to open in browser tabs
const allLinks = contentElm.querySelectorAll("a[href]");
Expand Down
11 changes: 9 additions & 2 deletions ts/packages/shell/src/renderer/src/webSocketAPI.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,6 +99,7 @@ export async function createWebSocket(autoReconnect: boolean = true) {
const endpoint = `${protocol}://${url.hostname}${port}`;

return new Promise<WebSocket | undefined>((resolve) => {
let reconnecting = false;
console.log(`opening web socket to ${endpoint} `);
const webSocket = new WebSocket(endpoint);

Expand Down Expand Up @@ -162,8 +163,14 @@ export async function createWebSocket(autoReconnect: boolean = true) {
resolve(undefined);

// reconnect?
if (autoReconnect) {
createWebSocket().then((ws) => (globalThis.ws = ws));
if (autoReconnect && !reconnecting) {
reconnecting = true;
createWebSocket().then((ws) => {
if (ws) {
globalThis.ws = ws;
}
reconnecting = false;
});
} else {
clientIOChannel.notifyDisconnected();
dispatcherChannel.notifyDisconnected();
Expand Down