0fc359dda6
Some checks failed
Caterium QA / qa (push) Failing after 8m6s
Inline handlers built as onclick="fn('${esc(id)}')" were injectable:
esc() turns ' into ', which the browser decodes back to ' before
the JS runs, so an id like x');alert(1);// broke out of the string.
Ids can come from a restored backup file or a synced catalog. Add
SunSafe.jsArg (JSON.stringify + HTML escape) and use it in all 24
handlers across app-runtime.js and index.html, including the new
banquet-menu ones. Verified locally: an id containing a JS payload
is passed through as a plain string and nothing executes.
Also replace the Settings version label that still showed
v17.6.0 · 2026.09.07 with the current release, and bump the script
cache-busting string so the fix reaches browsers.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
|
||
|---|---|---|
| .. | ||
| catalog | ||
| core | ||
| legacy | ||
| offer-gallery | ||
| offer-templates | ||
| .htaccess | ||
| app-runtime.js | ||
| caterium-login-logo.png | ||
| caterium-mark-light.svg | ||
| index.html | ||
| manifest.webmanifest | ||
| pwa-icon-192.png | ||
| pwa-icon-512.png | ||
| refresh-login-20260912.html | ||
| service-worker.js | ||
| sun-logo.png | ||
