-
-
Notifications
You must be signed in to change notification settings - Fork 50
Split points by documents #120
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: master
Are you sure you want to change the base?
Changes from all commits
4a28e22
145eb11
1412bb1
c2cc935
6f297e1
ba08347
8aeb951
78a8b53
d95fc5a
60091f4
65f02a8
f7efcf9
e534bef
4381737
de4ffca
6547ea4
1c86882
39b074a
e12cb1a
14e8670
0219c4d
405e067
b55d34e
15a01fd
54aa075
132a165
5fd853c
775d3b1
b944b98
b11a284
1c327fb
31557cc
ac1986a
81f92ed
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -1,4 +1,4 @@ | ||||||||||||
| import { DEFAULT_API_URL } from '../../constants'; | ||||||||||||
| import { DEFAULT_API_URL} from '../../constants'; | ||||||||||||
| import { getLocal } from '../../lib/chromeStorage'; | ||||||||||||
| import { | ||||||||||||
| SupportedLanguage, | ||||||||||||
|
|
@@ -8,11 +8,13 @@ import { | |||||||||||
| let curatorMode = false; | ||||||||||||
| let apiUrl = DEFAULT_API_URL; | ||||||||||||
| let language: SupportedLanguage = 'en'; | ||||||||||||
| let pointListStyle:"docCategories" | "unified" = "unified" | ||||||||||||
|
|
||||||||||||
| export interface PopupPreferences { | ||||||||||||
| darkmode: boolean; | ||||||||||||
| curatorMode: boolean; | ||||||||||||
| language: SupportedLanguage; | ||||||||||||
| pointListStyle:"docCategories" | "unified" | ||||||||||||
| } | ||||||||||||
|
|
||||||||||||
| export function isCuratorMode(): boolean { | ||||||||||||
|
|
@@ -31,11 +33,16 @@ export function setApiUrl(url: string): void { | |||||||||||
| apiUrl = url; | ||||||||||||
| } | ||||||||||||
|
|
||||||||||||
| export function getPointListStyle() { | ||||||||||||
| return pointListStyle | ||||||||||||
| } | ||||||||||||
|
|
||||||||||||
| export async function hydrateState(): Promise<PopupPreferences> { | ||||||||||||
| const result = await getLocal(['darkmode', 'curatorMode', 'api', 'language']); | ||||||||||||
| const result = await getLocal(['darkmode', 'curatorMode', 'api', 'language', 'pointListStyle']); | ||||||||||||
|
|
||||||||||||
| const darkmode = Boolean(result['darkmode']); | ||||||||||||
| const storedCuratorMode = Boolean(result['curatorMode']); | ||||||||||||
| pointListStyle = result['pointListStyle'] as "docCategories" | "unified" | ||||||||||||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Add validation for type-asserted storage value. The type assertion Apply this diff: - pointListStyle = result['pointListStyle'] as "docCategories" | "unified"
+ const storedStyle = result['pointListStyle'];
+ pointListStyle = (storedStyle === "docCategories" || storedStyle === "unified")
+ ? storedStyle
+ : "docCategories";📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||
| setCuratorMode(storedCuratorMode); | ||||||||||||
|
|
||||||||||||
| const api = result['api']; | ||||||||||||
|
|
@@ -52,6 +59,7 @@ export async function hydrateState(): Promise<PopupPreferences> { | |||||||||||
| darkmode, | ||||||||||||
| curatorMode: storedCuratorMode, | ||||||||||||
| language: resolvedLanguage, | ||||||||||||
| pointListStyle, | ||||||||||||
| }; | ||||||||||||
| } | ||||||||||||
|
|
||||||||||||
|
|
||||||||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Critical: XSS vulnerability in createPointList.
Line 327 directly inserts
pointTitle(derived from API data) into HTML viainnerHTMLon line 330. This is a critical XSS vulnerability.Even though
pointTitleuses a fallback tolocalized_titleortitle, both come from the API and must be sanitized:function createPointList(pointsFiltered: ServicePoint[], pointsList: HTMLElement, last: boolean) { let added = 0; for (let i = 0; i < pointsFiltered.length; i++) { const point = document.createElement('div'); - const pointTitle = pointsFiltered[i]!.case?.localized_title ?? pointsFiltered[i]!.title; + const rawTitle = pointsFiltered[i]!.case?.localized_title ?? pointsFiltered[i]!.title; + const pointTitle = escapeHtml(rawTitle); let temp = ` <div class="point ${pointsFiltered[i]!.case.classification}">🧰 Tools
🪛 ast-grep (0.40.0)
[warning] 329-329: Direct modification of innerHTML or outerHTML properties detected. Modifying these properties with unsanitized user input can lead to XSS vulnerabilities. Use safe alternatives or sanitize content first.
Context: point.innerHTML = temp.trim()
Note: [CWE-79] Improper Neutralization of Input During Web Page Generation [REFERENCES]
- https://owasp.org/www-community/xss-filter-evasion-cheatsheet
- https://cwe.mitre.org/data/definitions/79.html
(dom-content-modification)
[warning] 329-329: Direct HTML content assignment detected. Modifying innerHTML, outerHTML, or using document.write with unsanitized content can lead to XSS vulnerabilities. Use secure alternatives like textContent or sanitize HTML with libraries like DOMPurify.
Context: point.innerHTML = temp.trim()
Note: [CWE-79] Improper Neutralization of Input During Web Page Generation [REFERENCES]
- https://www.dhairyashah.dev/posts/why-innerhtml-is-a-bad-idea-and-how-to-avoid-it/
- https://cwe.mitre.org/data/definitions/79.html
(unsafe-html-content-assignment)